UBUNTU-CVE-2026-69097

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

CVE-2026-69097

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

CVE-2026-69097 GitPython before 3.1.53 Config Injection via Submodule Names

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

CVE-2026-69097: Improper Neutralization of Special Elements in Output Used by a Downstream Component

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

PT-2026-71449

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.56 Description An argument injection issue exists in the Commit.count method, which forwards keyword arguments to git rev-list without utilizing the check unsafe options guard. An attacker capable of controlling...

PT-2026-67513

Name of the Vulnerable Software and Affected Versions Serverless-Devs @serverless-devs/s versions prior to 3.1.12 Description The s init command passes unsanitized user input to the child process.spawn function with the shell: true option enabled. An attacker can bypass the existing input...

EUVD-2026-52481

The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...

CVE-2026-51190

The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...

Linux Distros Unpatched Vulnerability : CVE-2026-69097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through...

Exploit for CVE-2025-68937

CVE-2025-68937 - Gitea/Forgejo Template Symlink RCE Automated...

Linux Distros Unpatched Vulnerability : CVE-2026-67326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers in...

vault-conductor v0.3.1

🗝️ vault-conductor An SSH Agent that provides SSH keys stored in Bitwarden Secret Manager as secrets. Supports SSH authentication and Git commit signing. Demo Features It implements the SSH Agent Protocol as a Unix domain socket server, acting as a secure bridge between your SSH clients and...

SUSE CVE-2026-45570

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containin...

[SECURITY] Fedora 43 Update: libgit2-1.9.6-1.fc43

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language with bindings...

[SECURITY] Fedora 43 Update: GitPython-3.1.55-1.fc43

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...

GHSA-4VPG-PFJ8-M33Q Duplicate Advisory: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-956x-8gvw-wg5v. This link is maintained to preserve external references. Original Description GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and...

PYSEC-2026-3980

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...

codev (>=0.5.1a10, <=0.7.4a3), git-repo (1.6.0) potentially affected by CVE-2026-67326 via gitpython (2.0.2)

gitpython PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - codev =0.5.1a10, =0.7.4a3 - git-repo 1.6.0 Source cves: CVE-2026-67326 Source advisory: OSV:PYSEC-2026-3980...

aws-client (>=0.10.0, <=0.11.0), git-repo (>=1.7.0, <=1.7.1) potentially affected by CVE-2026-67326 via gitpython (2.0.6)

gitpython PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - aws-client =0.10.0, =1.7.0, =1.7.1 Source cves: CVE-2026-67326 Source advisory: OSV:PYSEC-2026-3980...

git-semver (>=0.1.2, <=0.1.5) potentially affected by CVE-2026-67326 via gitpython (2.0.9)

gitpython PYPI version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - git-semver =0.1.2, =0.1.5 Source cves: CVE-2026-67326 Source advisory: OSV:PYSEC-2026-3980...