Threats tagged 'brew-snakemake-cve-2026-76217'

GitPython versions prior to 9.25.1 have a vulnerability in the IndexFile.remove() and Head.checkout() methods where passing the --pathspec-from-file option together with --pathspec-file-nul causes Git to treat the entire file as a single NUL-delimited pathspec. When the pathspec does not match any files, Git returns an error message that includes the entire contents of the specified file. This results in an arbitrary file read vulnerability where the contents of a caller-chosen file are exposed via the GitCommandError.stderr output.