CVE-2026-73620

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

CVE-2026-73620 GitPython before 3.1.57 Arbitrary File Overwrite and Read

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

CVE-2026-73620

GitPython 3.x has a vulnerability in which GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. This can enable --prefix to overwrite arbitrary files with repository content and -F to ...

CVE-2026-73620

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

CVE-2026-73620 GitPython before 3.1.57 Arbitrary File Overwrite and Read

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

EUVD-2026-57824

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

CVE-2026-73620 GitPython before 3.1.57 Arbitrary File Overwrite and Read

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

CVE-2026-73619

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

CVE-2026-73619

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

CVE-2026-73619 GitPython before 3.1.57 Arbitrary File Read via Repo.archive()

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

CVE-2026-73619

GitPython before 3.1.57 is affected by an incomplete denylist in the unsafe_git_archive_options guard, which omits the --add-file and --add-virtual-file options. This allows an attacker to craft calls to Repo.archive() that can read arbitrary files from the filesystem and include them in the resu...

EUVD-2026-57823

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

CVE-2026-73619 GitPython before 3.1.57 Arbitrary File Read via Repo.archive()

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

CVE-2026-73619 GitPython before 3.1.57 Arbitrary File Read via Repo.archive()

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

CVE-2026-73619

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

Johnson Controls Inc. Airwall

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to decrypt sensitive data, bypass authentication controls, gaining unauthorized access to read arbitrary files on the system, or gain unauthorized access to protected system resources. 2. RECOMMENDED...

PT-2026-80311

The optional dashboard HTTP server atomic agents/dashboard/serve.py builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through io.safe resolve under. Literal ../...

CVE-2026-73653: Improper Limitation of a Pathname to a Restricted Directory

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

CVE-2026-53802: UNIX Symbolic Link (Symlink) Following

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

PT-2026-75984

Summary nltk.data.load and nltk.data.find resolve user-supplied resource names to filesystem paths using url2pathname, which decodes percent-encoded sequences e.g. %2e%2e to ... Path safety checks are performed on the raw, still-encoded string before decoding occurs. An attacker supplying %2e%2e...