Threats Tagged 'brew-tach-cve-2026-78679'

A vulnerability in GitPython's TagReference.create() method allows an attacker to read arbitrary local files by bypassing unsafe option guards with a specially crafted positional argument. This causes the contents of arbitrary files to be returned in the annotated tag message. The issue affects GitPython versions up to 3.1.58 and requires the embedding application to forward a user-controlled reference value. A fix is available that properly checks positional arguments or separates them with '--' to prevent this bypass. This vulnerability is relevant to Red Hat Satellite and related container images as noted in the Red Hat security advisory.