Threats tagged 'brew-tach-cve-2026-76219'

GitPython versions before 3.1.58 contain a vulnerability in the IndexFile.from_tree, reset, and merge_tree methods. These methods forward git read-tree options without proper safety checks, allowing an attacker to inject the --index-output option and overwrite arbitrary files with a valid git-index blob. This can lead to arbitrary file overwrite or destruction with the privileges of the host process. A patch is available to address this issue by adding safety checks and separators to prevent unsafe option forwarding.