9 matches found
CVE-2026-4660-PoC
CVE-2026-4660 PoC CVE-2026-4660에 대한 개념 증명HashiCorp 권고은 hashicorp/go-getter에 대한 것입니다. 저는 최초 보고자입니다. 공격자는 ref가 --pathspec-from-file=/path/to/file인 Terraform 모듈을 게시합니다. 피해자가 terraform init을 실행하면 go-getter가 저장소를 클론하고 git checkout --pathspec-from-file=/path/to/file을 호출합니다. Git은 대상 파일을 줄 단위로 읽고, 각 줄이...
SUSE CVE-2026-76217
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...
Duplicate Advisory: GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hh9p-6wh2-4mfc. This link is maintained to preserve external references. Original Description GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in...
CVE-2026-76217 GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...
CVE-2026-76217
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...
EUVD-2026-62458
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...
CVE-2026-76217 GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...
GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
Summary IndexFile.remove and Head.checkout forward kwargs into git rm and git checkout with no guard. Passing --pathspec-from-file= together with --pathspec-file-nul makes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec error quotes it verbatim. GitPython...
GHSA-HH9P-6WH2-4MFC GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
Summary IndexFile.remove and Head.checkout forward kwargs into git rm and git checkout with no guard. Passing --pathspec-from-file= together with --pathspec-file-nul makes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec error quotes it verbatim. GitPython...