PT-2026-69908

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch...

CVE-2026-72867: Improper Input Validation

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch...

PT-2026-81152

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description GitPython fails to include the --separate-git-dir flag in its unsafe git clone options. This allows an attacker to provide a separate git dir parameter to the Repo.clone from or Repo.clone...

Malicious code in stretchshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 479c1238e6380db5463eb3755b980f963d269b2b0874d464b9e1b3b65bd03f60 package.json declares a postinstall hook that runs node demo/demo.js base, which shell-invokes git clone...

MAL-2026-13460 Malicious code in stretchshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 479c1238e6380db5463eb3755b980f963d269b2b0874d464b9e1b3b65bd03f60 package.json declares a postinstall hook that runs node demo/demo.js base, which shell-invokes git clone...

PT-2026-68132

Name of the Vulnerable Software and Affected Versions ESPHome versions prior to 2026.7.0-dev Description An operator-precedence bug exists in the cv.url validator within esphome/config validation.py. Due to the and operator binding tighter than or, any file: URI passes validation regardless of th...

CLSA-2026-1774398084 TuxCare security update for git-clone (5 CVEs)

TuxCare rebuilt git-clone to address 5 CVEs. Fixed in 0.1.0-tuxcare.1...

PT-2026-74118

TuxCare rebuilt git-clone to address 4 CVEs. Fixed in 0.1.0-tuxcare.1...

CVE-2026-67324

A flaw was found in GitPython. A remote attacker can exploit a vulnerability where the software fails to properly recognize joined short-option forms e.g., -u when enforcing its default unsafe-option gate. This allows the attacker to bypass security checks and execute arbitrary commands during a...

PT-2026-71451

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.54 Description An incomplete denylist in unsafe git clone options omits the --template option, which allows for arbitrary command execution during clone operations. An attacker can provide a --template value...

NPM: n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

NPM: n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

Impact A TOCTOU race condition in the Git node's clone operation lets an authenticated user bypass its path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This plants a crafted repository in the community node directory, which n8n loads a...

CVE-2026-65598 n8n before 1.123.64 Remote Code Execution via Git Clone

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65598

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65598 n8n before 1.123.64 Remote Code Execution via Git Clone

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

EUVD-2026-47642

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65598

CVE-2026-65598 affects n8n versions before 1.123.64 (also 2.29.8 and 2.30.1). A TOCTOU race in the Git node’s clone operation allows an authenticated user to bypass path restrictions by swapping a directory for a symlink after path validation but before the clone runs. An attacker can plant a cra...

PT-2026-63356

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-16493: Improper Neutralization of Argument Delimiters in a Command

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

PYSEC-2026-2463 Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows

Impact Arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted tree entries whose filenames contained bytes that Windows interprets as structural path syntax: - \ — the Windows path...