Threats tagged 'brew-nbdime-cve-2026-42215'

GitPython versions from 3.1.1_1 up to but not including 4.0.4_2 contain a command injection vulnerability via unsafe handling of certain Git options passed as Python keyword arguments. The vulnerability arises because the safety check blocks dangerous Git options only when passed with hyphenated names, but not when passed using underscore-form kwargs, which are later converted to the dangerous flags. This allows attacker-controlled input to execute arbitrary commands during Git operations such as clone, fetch, pull, and push. A fix is available in version 4.0.4_2.