Threats tagged 'brew-snakemake-cve-2026-87818'

GitPython 3.1.59 contains a vulnerability in its high-level diff API where the --no-index option bypasses protections against unsafe git diff options. This allows an attacker who can influence diff options and paths to use a blind local-file content oracle to infer contents of local files accessible to the GitPython process. The issue arises because --no-index treats path arguments as arbitrary filesystem paths, and when combined with the -I/--ignore-matching-lines option, it creates a content-dependent Boolean oracle. This vulnerability was confirmed in version 3.1.59 and is fixed in version 9.26.0 of the affected product, snakemake. Exploitation requires the embedding application to expose success/error distinctions and allow repeated queries with attacker-controlled inputs.