CVE-2026-28291: Git Upload Pack Blocklist Bypasscve-2026-28291-git-upload-pack-blocklist-bypass
Validation of Git arguments using the regex `/^\s*-u\b/` is insufficient to prevent dangerous option injection. Git allows single-letter options to be grouped (e.g., `-vu`, `-4u`), which bypasses this regex check. Attackers could execute arbitrary code by passing a modified `-u` (upload-pack) option. Use a more robust check that accounts for Git's option gro
