Threats tagged 'brew-tern-cve-2026-110857'

GitPython versions 2.12.0 and later contain vulnerabilities in three wrapper methods that omit critical unsafe protocol and option checks. The ls_remote method forwards URLs without checking for unsafe protocols, allowing remote code execution (RCE) if the victim's git transport policy permits the 'ext' transport. The merge_base and IndexFile.move methods forward caller-controlled arguments without proper option checks, creating latent argument-injection surfaces. These issues were verified on the main branch as of September 2026 and remain unpatched in the latest release 3.1.62. The severity is high due to the potential for RCE in certain configurations.