Threats tagged 'brew-tach-cve-2026-76218'

GitPython versions up to 3.1.57 contain a remote code execution vulnerability in the Repo.init method. This method forwards unsafe git options without validation, allowing an attacker to specify a malicious --template directory with executable git hooks. When Repo.init is called with such a crafted template path, git copies attacker-controlled hooks into the new repository, leading to arbitrary code execution during subsequent git operations. A patch is available that adds validation to prevent unsafe options.