tern
Install command:
brew install ternSoftware Bill of Materials (SBOM) tool
https://github.com/tern-tools/tern
License: BSD-2-Clause
Development: Pull requests
Formula JSON API: /api/formula/tern.json
Formula code: tern.rb on GitHub
Bottle (binary package) installation support provided for:
| macOS on Apple Silicon |
tahoe | ✅ |
|---|---|---|
| sequoia | ✅ | |
| sonoma | ✅ | |
| macOS on Intel |
sonoma | ✅ |
| Linux | ARM64 | ✅ |
| x86_64 | ✅ | |
Current versions:
| stable | ✅ | 2.12.1 |
| head | ⚡️ | HEAD |
Depends on:
| certifi | 2026.7.22 | Mozilla CA bundle for Python |
| libyaml | 0.2.5 | YAML Parser |
| python@3.14 | 3.14.7 | Interpreted, interactive, object-oriented programming language |
| tern requires root privileges so you will need to run `sudo tern`. You should be certain that you trust any software you grant root privileges. |
Known vulnerabilities in the current version:
| GHSA-38jv-5279-wg99 (high) | Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) |
| GHSA-gc5v-m9x4-r6x2 (medium) | Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function |
| GHSA-rpm5-65cw-6hj4 (high) | GitPython has Command Injection via Git options bypass |
| GHSA-x2qx-6953-8485 (high) | GitPython: Unsafe option check validates multi_options before shlex.split transformation |
| GHSA-7545-fcxq-7j24 (high) | GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and ... |
| GHSA-v87r-6q3f-2j67 (high) | GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath |
| GHSA-qccp-gfcp-xxvc (medium) | urllib3: Sensitive headers forwarded across origins in proxied low-level redirects |
| GHSA-mf9v-mfxr-j63j (high) | urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API |
| GHSA-65pc-fj4g-8rjx (medium) | Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() ... |
| GHSA-h35f-9h28-mq5c (medium) | setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) o... |
| GHSA-rwj8-pgh3-r573 (high) | GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL |
| GHSA-956x-8gvw-wg5v (high) | GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, an... |
| GHSA-2f96-g7mh-g2hx (high) | GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blo... |
| GHSA-mv93-w799-cj2w (high) | GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, ... |
| GHSA-3rp5-jjmw-4wv2 (high) | GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand... |
| GHSA-539m-9xh6-q6rr (medium) | GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, ... |
| GHSA-3f7w-8rr8-f37f (high) | GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enab... |
| GHSA-p538-c434-8v24 (medium) | GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Co... |
| GHSA-94p4-4cq8-9g67 (high) | GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incompl... |
| GHSA-6p8h-3wgx-97gf (high) | GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary comma... |
| GHSA-fjr4-x663-mwxc (high) | GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (ke... |
| GHSA-r9mr-m37c-5fr3 (high) | GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enable... |
| GHSA-hh9p-6wh2-4mfc (medium) | GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout() |
| GHSA-9rj7-rf2p-w77r (high) | GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via -... |
| GHSA-4gmw-gg2m-w46p (high) | GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enab... |
| GHSA-wvpp-8hx9-p66j (high) | GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token ... |
| GHSA-jm78-9fvv-mhgr (high) | GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling ... |
| GHSA-hmq2-w58f-27jc (high) | GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules... |
| GHSA-3f7w-8rr8-f37f (high) | GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enab... |
| GHSA-4gmw-gg2m-w46p (high) | GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enab... |
| GHSA-539m-9xh6-q6rr (medium) | GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, ... |
| GHSA-6p8h-3wgx-97gf (high) | GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary comma... |
| GHSA-94p4-4cq8-9g67 (high) | GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incompl... |
| GHSA-9rj7-rf2p-w77r (high) | GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via -... |
| GHSA-fjr4-x663-mwxc (high) | GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (ke... |
| GHSA-hh9p-6wh2-4mfc (medium) | GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout() |
| GHSA-hmq2-w58f-27jc (high) | GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules... |
| GHSA-jm78-9fvv-mhgr (high) | GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling ... |
| GHSA-p538-c434-8v24 (medium) | GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Co... |
| GHSA-r9mr-m37c-5fr3 (high) | GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enable... |
| GHSA-wvpp-8hx9-p66j (high) | GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token ... |
Data from Homebrew/advisory-database. Run brew vulns tern for a live check.
Analytics:
| 30 days | 90 days | 365 days | |
|---|---|---|---|
| Installs | 36 | 61 | 196 |
| Installs on Request | 36 | 61 | 196 |
| Build Errors | 9 |