tern
Install command:
brew install ternSoftware Bill of Materials (SBOM) tool
https://github.com/tern-tools/tern
License: BSD-2-Clause
Development: Pull requests
Formula JSON API: /api/formula/tern.json
Formula code: tern.rb on GitHub
Bottle (binary package) installation support provided for:
| macOS on Apple Silicon |
golden gate | ✅ |
|---|---|---|
| tahoe | ✅ | |
| sequoia | ✅ | |
| Linux | ARM64 | ✅ |
| x86_64 | ✅ |
Current versions:
| stable | ✅ | 2.12.1 |
| head | ⚡️ | HEAD |
Depends on:
| certifi | 2026.10.19 | Mozilla CA bundle for Python |
| libyaml | 0.2.5 | YAML Parser |
| python@3.15 | 3.15.0 | Interpreted, interactive, object-oriented programming language |
Binaries:
tern
| tern requires root privileges so you will need to run `sudo tern`. You should be certain that you trust any software you grant root privileges. |
Known vulnerabilities in the current version:
| GHSA-wfm5-v35h-vwf4 (high) | GitPython untrusted search path on Windows systems leading to arbitrary code execution |
| GHSA-cwvm-v4w8-q58c (medium) | GitPython blind local file inclusion |
| GHSA-v845-jxx5-vc9f (medium) | `Cookie` HTTP header isn't stripped on cross-origin redirects |
| GHSA-g4mx-q9vg-27p4 (medium) | urllib3's request body not stripped after redirect from 303 status changes request method to GET |
| GHSA-2mqj-m65w-jghx (high) | Untrusted search path under some conditions on Windows allows arbitrary code execution |
| GHSA-9wx4-h78v-vm56 (medium) | Requests `Session` object does not verify requests after making first request with verify=False |
| GHSA-jjg7-2v4v-x38h (medium) | Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specia... |
| GHSA-34jh-p97f-mpxf (medium) | urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects |
| GHSA-9hjg-9r4m-mvj7 (medium) | Requests vulnerable to .netrc credentials leak via malicious URLs |
| GHSA-cx63-2mw6-8hw5 (high) | setuptools vulnerable to Command Injection via package URL |
| GHSA-5rjg-fvgr-3xxf | setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary Fi... |
| GHSA-pq67-6m6q-mj2v (medium) | urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation |
| GHSA-gm62-xv2j-4w53 | urllib3 allows an unbounded number of links in the decompression chain |
| GHSA-2xpw-w6gg-jr37 | urllib3 streaming API improperly handles highly compressed data |
| GHSA-59cr-6r3x-644w | GitPython submodule update path traversal can write outside the repository |
| GHSA-38jv-5279-wg99 (high) | Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) |
| GHSA-gc5v-m9x4-r6x2 (medium) | Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function |
| GHSA-rpm5-65cw-6hj4 (high) | GitPython has Command Injection via Git options bypass |
| GHSA-x2qx-6953-8485 (high) | GitPython: Unsafe option check validates multi_options before shlex.split transformation |
| GHSA-7545-fcxq-7j24 (high) | GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and ... |
| GHSA-v87r-6q3f-2j67 (high) | GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath |
| GHSA-qccp-gfcp-xxvc (medium) | urllib3: Sensitive headers forwarded across origins in proxied low-level redirects |
| GHSA-mf9v-mfxr-j63j (high) | urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API |
| GHSA-65pc-fj4g-8rjx (medium) | Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() ... |
| GHSA-h35f-9h28-mq5c (medium) | setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) o... |
| GHSA-rwj8-pgh3-r573 (high) | GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL |
| GHSA-956x-8gvw-wg5v (high) | GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, an... |
| GHSA-2f96-g7mh-g2hx (high) | GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blo... |
| GHSA-mv93-w799-cj2w (high) | GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, ... |
| GHSA-3rp5-jjmw-4wv2 (high) | GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand... |
| GHSA-539m-9xh6-q6rr (medium) | GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, ... |
| GHSA-3f7w-8rr8-f37f (high) | GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enab... |
| GHSA-p538-c434-8v24 (medium) | GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Co... |
| GHSA-94p4-4cq8-9g67 (high) | GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incompl... |
| GHSA-6p8h-3wgx-97gf (high) | GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary comma... |
| GHSA-fjr4-x663-mwxc (high) | GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (ke... |
| GHSA-r9mr-m37c-5fr3 (high) | GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enable... |
| GHSA-hh9p-6wh2-4mfc (medium) | GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout() |
| GHSA-9rj7-rf2p-w77r (high) | GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via -... |
| GHSA-4gmw-gg2m-w46p (high) | GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enab... |
| GHSA-wvpp-8hx9-p66j (high) | GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token ... |
| GHSA-jm78-9fvv-mhgr (high) | GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling ... |
| GHSA-hmq2-w58f-27jc (high) | GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules... |
| GHSA-7833-fr7j-v32q (high) | GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodul... |
| GHSA-284h-m62q-gf8w (critical) | GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g.... |
| GHSA-8mcc-hrx5-hvxc (high) | GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling a... |
| GHSA-5xxx-qhh7-9287 (medium) | GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrar... |
| GHSA-3wxw-xv34-2frg (medium) | GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling a... |
| PYSEC-2026-3982 (high) | GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution |
| PYSEC-2026-3984 (high) | GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — co... |
| GHSA-8988-9cw3-xx77 | urllib3: HTTPS proxy TLS configuration may be ignored or overridden |
| GHSA-gh4c-6fx4-qh6g | urllib3: Chunked Deflate streaming can enter an infinite loop |
| GHSA-vxq7-64xx-v4gw | urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory |
Data from Homebrew/advisory-database. Run brew vulns tern for a live check.
Analytics:
| 30 days | 90 days | 365 days | |
|---|---|---|---|
| Installs | 16 | 55 | 161 |
| Installs on Request | 16 | 55 | 161 |
| Build Errors | 0 |