Threats tagged 'brew-mistral-vibe-cve-2026-67326'

A vulnerability in GitPython's config_writer() allows newline injection in the section parameter, bypassing the patch for CVE-2026-42215. This enables an attacker to inject arbitrary section headers into the .git/config file, including a forged [core] section with hooksPath pointing to an attacker-controlled directory. This leads to remote code execution (RCE) when any git hook is triggered. The issue affects versions >=2.1.0 <2.9.5 and >=2.10.0 <2.18.0 and is fixed in versions 2.9.5 and 2.18.0.