airflow-indexima (>=1.0.1, <=2.2.1), arcli (>=0.1.0, <=0.1.1) +69 more potentially affected by CVE-2026-76222 via gitpython (2.1.15)

gitpython PYPI version 2.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - airflow-indexima =1.0.1, =0.1.0, =0.3.0rc1, =0.1.0, =0.7.0, =0.2.0, =0.11.0, =0.1.0, =0.6.0, =0.3.0, =2.0.0, =2019.2.3rc0, =2021.7.0 and more...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +772 more potentially affected by CVE-2026-76222 via gitpython (>=3.0.0, <=3.1.57)

gitpython PYPI version =3.0.0, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-76222 Source advisory: GHSA-HMQ2-W58F-27JC...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +772 more potentially affected by CVE-2026-76222 via gitpython (>=3.0.0, <=3.1.57)

gitpython PYPI version =3.0.0, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-76222 Source advisory: OSV:GHSA-HMQ2-W58F-27JC...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +772 more potentially affected by CVE-2026-76222 via gitpython (>=3.0.0, <=3.1.57)

gitpython PYPI version =3.0.0, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-76222 Source advisory: SNYK:PYTHON-GITPYTHON-18592310...

External Control of File Name or Path

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path in the remove and checkout functions. An attacker can access the contents of arbitrary files by supplying crafted arguments to...

GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

Summary IndexFile.remove and Head.checkout forward kwargs into git rm and git checkout with no guard. Passing --pathspec-from-file= together with --pathspec-file-nul makes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec error quotes it verbatim. GitPython...

elemeno-ai-sdk (>=0.0.5, <=0.0.20), foresthog (>=0.9.0, <=1.3.6) +7 more potentially affected by CVE-2026-76217 via gitpython (2.1.1)

gitpython PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - elemeno-ai-sdk =0.0.5, =0.9.0, =0.1.0, =0.4.0, =0.0.5, =0.0.1, =1.0.0, =1.0.4, =1.0.10 Source cves: CVE-2026-76217 Source advisory:...

freedom (>=0.0.0_21_g3038804_dirty, <=0.0.1) potentially affected by CVE-2026-76217 via gitpython (0.3.4)

gitpython PYPI version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - freedom =0.0.021g3038804dirty, =0.0.1 Source cves: CVE-2026-76217 Source advisory: OSV:GHSA-HH9P-6WH2-4MFC...

arca (>=0.1.1, <=0.3.1), epab (>=2018.4.2.1, <=2018.4.2.3) +3 more potentially affected by CVE-2026-76217 via gitpython (2.1.9)

gitpython PYPI version 2.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.1, =2018.4.2.1, =1.0.3, =0.0.0, =0.4.1 - ubuntudesign-documentation-builder 1.6.0 Source cves: CVE-2026-76217 Source advisory:...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +772 more potentially affected by CVE-2026-76217 via gitpython (>=3.0.0, <=3.1.57)

gitpython PYPI version =3.0.0, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-76217 Source advisory: GHSA-HH9P-6WH2-4MFC...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +772 more potentially affected by CVE-2026-76217 via gitpython (>=3.0.0, <=3.1.57)

gitpython PYPI version =3.0.0, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-76217 Source advisory: SNYK:PYTHON-GITPYTHON-18592311...

android-category (>=0.0.3, <=0.0.4), ant-cli (0.0.1) +34 more potentially affected by CVE-2026-76217 via gitpython (2.1.11)

gitpython PYPI version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - android-category =0.0.3, =0.0.2, =0.3.0, =0.0.2, =0.12.4rc1, =0.1.26.dev1542857464, =0.2.3, =0.1.0, =0.0.1, =1.2.5, =0.1.0.0b1, =0.1.3 and mo...

gpopt (>=0.1.0, <=0.2.3) potentially affected by CVE-2026-76217 via gitpython (0.3.6)

gitpython PYPI version 0.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - gpopt =0.1.0, =0.2.3 Source cves: CVE-2026-76217 Source advisory: OSV:GHSA-HH9P-6WH2-4MFC...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-76217 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-76217 Source advisory: OSV:GHSA-HH9P-6WH2-4MFC...

dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2026-76217 via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2026-76217 Source advisory: OSV:GHSA-HH9P-6WH2-4MFC...

GHSA-HH9P-6WH2-4MFC GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

Summary IndexFile.remove and Head.checkout forward kwargs into git rm and git checkout with no guard. Passing --pathspec-from-file= together with --pathspec-file-nul makes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec error quotes it verbatim. GitPython...

elib (>=0.1.55, <=0.1.57), emiz (>=0.1.35, <=2018.4.2.1) +11 more potentially affected by CVE-2026-76217 via gitpython (2.1.8)

gitpython PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - elib =0.1.55, =0.1.35, =0.2.4a149, =0.0.1, =1.0.0, =0.4233.0, =0.2354.0, =0.2354.0, =0.1.7, =0.2.120, =1.0.0, =0.1.0, =2.1.1 Source cves:...

cabrita (>=2.2.2b1, <=2.2.2b2), cico (>=0.1.0, <=0.1.8) +4 more potentially affected by CVE-2026-76217 via gitpython (2.1.10)

gitpython PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - cabrita =2.2.2b1, =0.1.0, =0.1.0, =3.11.1, =0.9.0, =0.9.7.2 Source cves: CVE-2026-76217 Source advisory: OSV:GHSA-HH9P-6WH2-4MFC...

git-semver (>=0.1.2, <=0.1.5) potentially affected by CVE-2026-76217 via gitpython (2.0.9)

gitpython PYPI version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - git-semver =0.1.2, =0.1.5 Source cves: CVE-2026-76217 Source advisory: OSV:GHSA-HH9P-6WH2-4MFC...

airflow-indexima (>=1.0.1, <=2.2.1), arcli (>=0.1.0, <=0.1.1) +69 more potentially affected by CVE-2026-76217 via gitpython (2.1.15)

gitpython PYPI version 2.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - airflow-indexima =1.0.1, =0.1.0, =0.3.0rc1, =0.1.0, =0.7.0, =0.2.0, =0.11.0, =0.1.0, =0.6.0, =0.3.0, =2.0.0, =2019.2.3rc0, =2021.7.0 and more...