Critical flaw in new tool could allow attackers to steal data at will from developers working with untrusted repositories.

The vulnerability, which allows remote command injection with no authentication required, carries a severity rating of 9.8 out of a possible 10. It’s easy to exploit by sending simple HTTP or ...