Threats tagged 'brew-nbdime-cve-2026-67325'

GitPython versions from 1.1.0 up to but not including 4.0.4_4 contain a command injection vulnerability (CVE-2026-67325) due to incomplete blocking of unsafe git options. The vulnerability arises because the fix for a previous issue (CVE-2026-42215) only blocked exact matches of dangerous options but did not account for git's acceptance of unambiguous long-option prefix abbreviations. This allows attackers controlling keyword argument keys to bypass the blocklist and execute arbitrary commands during clone, fetch, pull, or push operations. A fix is available in version 4.0.4_4.