Threats tagged 'brew-tern-cve-2026-110858'

GitPython's Remote.pull() method improperly handles its positional refspec argument, allowing an attacker controlling this input to inject a --upload-pack option that bypasses unsafe option guards. This leads to arbitrary command execution with the privileges of the calling process when pulling from local-path or SSH transports. The vulnerability arises because the unsafe option check only inspects keyword arguments, not the positional refspec, and git pull forwards the refspec to an internal fetch without a separator, enabling the injected option to be executed.