Threats Tagged 'brew-tach-cve-2026-78677'

GitPython versions prior to 3.27.0 and certain other version ranges contain a vulnerability where the clone_from() and clone() methods do not block the --separate-git-dir option by default. This allows an attacker controlling input to specify an arbitrary path for the Git metadata directory outside the intended clone destination, potentially leading to arbitrary directory and file creation limited by filesystem permissions. The vulnerability is due to an omission in the denylist of unsafe_git_clone_options. A patch is available for affected versions.