Threats tagged 'brew-shallow-backup-cve-2026-78677'

GitPython versions >=5.0.1 and <6.6_7 have a vulnerability in the clone_from() and clone() methods where the --separate-git-dir option is not blocked by the unsafe_git_clone_options denylist. This allows an attacker controlling input to specify an arbitrary path for the Git repository metadata directory, enabling creation of files and directories outside the intended clone destination. The flaw arises from a denylist parity gap between clone and init commands, despite documentation stating the option should be blocked by default.