Threats tagged 'brew-snakemake-cve-2026-87817'

GitPython versions from 5.5.3 up to but not including 9.26.0 contain a vulnerability where the repository's git directory is misresolved. This allows attacker-controlled repository content to impersonate the git directory, leading to arbitrary code execution when a victim performs a commit using GitPython. The flaw arises because GitPython tests candidate paths for the git directory in an order that considers the real .git directory last, enabling tracked files named gitdir, commondir, and HEAD to mislead the resolution. This can also lead to unauthorized reading of files outside the repository and writing config files to attacker-chosen locations. The issue is fixed in version 9.26.0.