Threats tagged 'brew-tach-cve-2026-76221'

GitPython versions up to 3.1.57 contain a vulnerability in the config-name validator that allows injection of arbitrary git configuration directives via crafted option names. This flaw enables attackers to forge directives such as core.sshCommand or core.hooksPath, potentially leading to remote code execution during subsequent git operations. The issue stems from insufficient validation that fails to reject characters like '=', '#', or whitespace in option names. A fix is available that applies stricter validation to option names.