Threats tagged 'brew-tach-cve-2026-76220'

GitPython versions up to 3.1.57 contain a vulnerability where the guard against unsafe git options can be bypassed by using the 'split_single_char_options=False' flag combined with a single-character keyword argument. This allows an attacker to smuggle a short option token that Git interprets as a command, leading to arbitrary OS command execution. The vulnerability is due to an incomplete fix of a previous issue and affects all guarded methods forwarding keyword arguments. A patch is available to address this issue.