GitPython Code Execution

The vulnerability of the Git configuration writing module in the Python library for interacting with Git repositories in GitPython is related to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability may allow an attacker to execute arbitrary...

GitPython Repo.clone_from() Code Execution

The vulnerability of the Repo.clonefrom function in the Python library for interacting with Git repositories in GitPython is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code remotely...

GitPython Code Execution

The vulnerability of the checkunsafeoptions function in the Python library for interacting with Git repositories, GitPython, is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability may allow a remote attacker to execute arbitrary code...

GitPython Repo.clone_from() Unauthorized Access

The vulnerability of the Repo.clonefrom function in the Python library for interacting with Git repositories in GitPython is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

CLSA-2026-1784077474 TuxCare security update for gitpython (1 CVE)

TuxCare rebuilt gitpython to address 1 CVE. Fixed in 3.1.31.post2+tuxcare...

CLSA-2026-1784077479 TuxCare security update for gitpython (2 CVEs)

TuxCare rebuilt gitpython to address 2 CVEs. Fixed in 3.1.31.post3+tuxcare...

CLSA-2025-1759191117 TuxCare security update for gitpython (1 CVE)

TuxCare rebuilt gitpython to address 1 CVE. Fixed in 3.1.31.post1+tuxcare...

PT-2026-78402

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description A command execution issue exists in the check unsafe options guard. This guard can be bypassed by combining a single-character kwarg with split single char options=False. An attacker can provide a...

PT-2026-78404

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description GitPython fails to validate submodule names within .gitmodules files. This allows an attacker to use traversal sequences in submodule names during submodule initialization to create Git repositori...

PT-2026-73555

TuxCare rebuilt gitpython to address 1 CVE. Fixed in 3.1.31.post1+tuxcare...

PT-2026-75420

TuxCare rebuilt gitpython to address 2 CVEs. Fixed in 3.1.31.post3+tuxcare...

PT-2026-78403

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description A config-name injection issue exists in the option-name validator. This allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into optio...

PT-2026-75415

TuxCare rebuilt gitpython to address 1 CVE. Fixed in 3.1.31.post2+tuxcare...

PT-2026-78401

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description An arbitrary file overwrite issue exists in the IndexFile.from tree, IndexFile.reset, and IndexFile.merge tree methods. These methods append caller-influenced treeish strings to the git read-tree...

SUSE CVE-2026-67322

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

SUSE CVE-2026-67323

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote, allowing command injection via options such as --exec/--upload-pack leading to arbitrary command execution. Additionally, Repo.itercommits and Repo.blame do not check...

SUSE CVE-2026-67325

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uploadp instead of uploadpack, which git resolves to dangerous...

SUSE CVE-2026-67326

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...

CVE-2026-67323

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

dotcli (>=0.1.4, <=0.1.7), giraumon (0.0.1) +3 more potentially affected by CVE-2026-73621 via gitpython (2.1.5)

gitpython PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dotcli =0.1.4, =1.0.1, =1.0.0, =1.0.18 Source cves: CVE-2026-73621 Source advisory: OSV:GHSA-P538-C434-8V24...