Threats tagged 'brew-tach-cve-2026-44244'

GitPython's config_writer().set_value() method prior to version 3.1.49 does not validate input values for newline characters, allowing injection of malicious core.hooksPath configuration. This vulnerability enables remote code execution by redirecting Git hook execution to attacker-controlled scripts. Applications passing untrusted input to set_value(), such as MLRun's project.push(), are affected. A fix is available that rejects values containing CR, LF, or NUL characters.