Threats tagged 'brew-snakemake-cve-2026-76218'

GitPython's Repo.init() method forwards keyword arguments directly to git init without guarding unsafe options like --template. This allows an attacker who can control the template path to plant malicious git hooks that execute arbitrary code during subsequent git operations. The vulnerability affects GitPython versions up to 3.1.57 and is fixed in version 9.25.1. Exploitation requires the attacker to stage an executable hook directory and influence the template argument passed to Repo.init().