Threats tagged 'brew-snakemake-cve-2026-76219'

GitPython versions up to 3.1.57 contain a vulnerability in the IndexFile.from_tree, reset, and merge_tree methods where unguarded forwarding of positional treeish arguments to git read-tree allows an attacker to overwrite arbitrary files with a valid git-index blob. This occurs because the methods do not check or block unsafe options like --index-output, enabling an attacker to specify an arbitrary output path. The impact is arbitrary file overwrite at the privileges of the host process, potentially corrupting or destroying important files. A fix is available in version 9.25.1 that adds guards against unsafe options and places a separator to prevent option injection.