21 matches found
PT-2026-120814
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.2.1 Description The create submodule function in git/objects/submodule/base.py accepts an attacker-influenced submodule path and invokes clone repo before rejecting the destination. In versions 3.1.x, the validate...
GitPython submodule update path traversal can write outside the repository
Affected: GitPython 3.1.61 latest release and main — git/objects/submodule/base.py. git diff 3.1.61 origin/main -- git/objects/submodule/ is empty, so both are identical here. --- The gap The fix for GHSA-hmq2-w58f-27jc added Submodule.validatedname and wired it into update and five siblings,...
GHSA-59CR-6R3X-644W GitPython submodule update path traversal can write outside the repository
Affected: GitPython 3.1.61 latest release and main — git/objects/submodule/base.py. git diff 3.1.61 origin/main -- git/objects/submodule/ is empty, so both are identical here. --- The gap The fix for GHSA-hmq2-w58f-27jc added Submodule.validatedname and wired it into update and five siblings,...
Exploit for CVE-2026-38526
Nexus — Local Privilege Escalation PoC Gitea template-sync...
go-git: Malformed Git object data may cause panics or resource exhaustion
Impact Several denial-of-service issues were identified in go-git when parsing maliciously crafted Git repository data. An attacker may craft a malicious .pack, .idx or loose objects that causes an application using an affected version of go-git to panic or consume excessive resources. This can...
EUVD-2026-30563
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git...
Incorrect Behavior Order: Validate Before Canonicalize
Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the parsing of Git objects with malformed or ambiguous commit or tag objects. An attacker can cause inconsistent interpretation of object metadata or signature validation by...
SUSE CVE-2025-31130
gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1smol or sha1 crate, both of which implement standard SHA-1 without any mitigations...
CVE-2025-31130 gitoxide does not detect SHA-1 collision attacks
gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1smol or sha1 crate, both of which implement standard SHA-1 without any mitigations...
SHA-1 collision attacks are not detected
Summary gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. Details gitoxide uses the sha1smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct G...
PT-2025-14868
Name of the Vulnerable Software and Affected Versions gitoxide versions prior to 0.42.0 Description The issue arises from gitoxide's use of SHA-1 hash implementations without collision detection, making it vulnerable to hash collision attacks. This means two distinct Git objects with colliding...
DEBIAN-CVE-2024-25817
Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components...
CVE-2024-25817
Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components...
CVE-2024-25817
Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components...
UBUNTU-CVE-2024-25817
Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components...
CVE-2024-25817
Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components...
CVE-2024-25817
Affected software: eza (before v0.18.2). Root cause / vulnerability: Buffer overflow allowing local attackers to execute arbitrary code through .git/HEAD, .git/refs, and .git/objects components.** Impact:** Local code execution with high impact as described in multiple advisories. References from...
CVE-2024-25817
Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components...
CVE-2024-25817: Buffer Copy without Checking Size of Input
Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components...
