Threats tagged 'brew-shallow-backup-cve-2026-76221'

GitPython versions up to 3.1.57 contain a vulnerability in the config-name validator that allows injection of arbitrary git configuration directives via crafted option names. The validator fails to reject characters such as '=', '#', ';', '[', ']', and whitespace in option names, enabling attackers to forge config directives like core.sshCommand or core.hooksPath. This can lead to remote code execution on subsequent git operations if the application forwards attacker-controlled option names to the config writer.