33 matches found
EUVD-2026-65223
GitPython: clonefrom/clone omit --separate-git-dir from unsafegitcloneoptions, enabling arbitrary git-directory creation outside the destination...
GitPython: GitPython: Arbitrary code execution via improper validation of clone options
A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the clone function. By crafting a malicious string in the multioptions parameter, an attacker could bypass validation. This allows for the...
DEBIAN-CVE-2026-78677
GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...
CVE-2026-78677
GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...
Linux Distros Unpatched Vulnerability : CVE-2026-78677
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone...
Astra Linux – Vulnerability in python-git
GitPython before version 3.1.32 does not prevent the use of insecure non-multi options in clone and clonefrom commands. NOTE: This issue exists due to an incomplete fix for CVE-2022-24439...
DEBIAN-CVE-2026-73623
GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...
CVE-2026-73623
GitPython prior to 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, enabling attackers to achieve arbitrary command execution during clone operations. By supplying --template pointing to a directory with malicious post-checkout hooks, an attacker could tri...
CVE-2026-67324
GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...
PYSEC-2026-3947
GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...
UBUNTU-CVE-2026-67324
GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...
CVE-2026-67324
GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...
CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options
GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...
GHSA-6P8H-3WGX-97GF GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
Summary GitPython's unsafegitcloneoptions denylist omits --template. git clone --template= copies /hooks/ into the new repository and runs them post-checkout fires during clone, so a caller who can influence clone options can achieve arbitrary command execution in the default...
GHSA-V396-V7Q4-X2QJ GitPython unsafe clone option gate bypass through joined short options
GitPython version 3.1.50 blocks unsafe git clone options such as --upload-pack, -u, --config, and -c unless callers explicitly pass allowunsafeoptions=True. However, the default unsafe-option gate does not recognize joined short-option forms such as -u/path/to/helper. Git itself accepts -u as the...
GitPython: GitPython: Arbitrary code execution via improper validation of clone options
A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the clone function. By crafting a malicious string in the multioptions parameter, an attacker could bypass validation. This allows for the...
GitPython: GitPython: Arbitrary code execution via improper validation of clone options
A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the clone function. By crafting a malicious string in the multioptions parameter, an attacker could bypass validation. This allows for the...
PT-2026-67304
Name of the Vulnerable Software and Affected Versions GitPython version 3.1.50 Description An issue exists where the software fails to recognize joined short-option forms, such as -u, which is the short form of --upload-pack=, when enforcing its default unsafe-option gate. If an application passe...
USN-8303-1: GitPython vulnerabilities
Santos Gallegos discovered that GitPython did not properly validate paths when resolving certain Git references. An attacker could possibly use this issue to cause files outside the .git directory to be accessed, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu...
USN-8303-1 python-git vulnerabilities
Santos Gallegos discovered that GitPython did not properly validate paths when resolving certain Git references. An attacker could possibly use this issue to cause files outside the .git directory to be accessed, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu...