Threats tagged 'brew-snakemake-cve-2026-76221'

GitPython versions up to 3.1.57 contain a vulnerability in the config-name validator that fails to properly sanitize option names. This allows injection of arbitrary git configuration directives such as core.sshCommand or core.hooksPath by embedding special characters (=, #, whitespace) in option names. As a result, an attacker controlling the option name can cause remote code execution on the next git operation. The issue arises because the validation logic applies strict checks only to section names, not option names, allowing malicious input to be written verbatim into the config file.