Threats tagged 'brew-snakemake-cve-2026-76220'

GitPython versions up to 3.1.57 contain a vulnerability where the unsafe git option guard can be bypassed by using the 'split_single_char_options=False' parameter combined with a single-character keyword argument. This bypass allows arbitrary OS command execution via the '--upload-pack' git option, despite the default safety setting 'allow_unsafe_options=False'. The flaw is due to incomplete validation of joined short-option tokens, enabling command injection in methods like clone, fetch, pull, and others that forward kwargs.