363 matches found
CVE-2026-67322
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...
EUVD-2026-51858
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uploadp instead of uploadpack, which git resolves to dangerous...
CVE-2026-67325 GitPython before 3.1.51 Command Injection via option prefix abbreviation
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uploadp instead of uploadpack, which git resolves to dangerous...
CVE-2026-67325 GitPython before 3.1.51 Command Injection via option prefix abbreviation
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uploadp instead of uploadpack, which git resolves to dangerous...
CVE-2026-67325
GitPython before 3.1.51 is vulnerable to a command injection issue due to an incomplete blocklist that does not account for git’s long-option prefix abbreviation. Attackers can bypass the unsafe options guard by using abbreviated option names (for example, upload_p instead of upload_pack); Git re...
CVE-2026-67325
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uploadp instead of uploadpack, which git resolves to dangerous...
ROOT-APP-PYPI-GHSA-2F96-G7MH-G2HX GHSA-2f96-g7mh-g2hx in rootio-GitPython - Patched by Root
Root has patched GHSA-2f96-g7mh-g2hx in the rootio-GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-MV93-W799-CJ2W GHSA-mv93-w799-cj2w in rootio-GitPython - Patched by Root
Root has patched GHSA-mv93-w799-cj2w in the rootio-GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-6P8H-3WGX-97GF GHSA-6p8h-3wgx-97gf in rootio-GitPython - Patched by Root
Root has patched GHSA-6p8h-3wgx-97gf in the rootio-GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-3RP5-JJMW-4WV2 GHSA-3rp5-jjmw-4wv2 in rootio-GitPython - Patched by Root
Root has patched GHSA-3rp5-jjmw-4wv2 in the rootio-GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-R9MR-M37C-5FR3 GHSA-r9mr-m37c-5fr3 in rootio-GitPython - Patched by Root
Root has patched GHSA-r9mr-m37c-5fr3 in the rootio-GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-44244 CVE-2026-44244 in rootio-GitPython - Patched by Root
Root has patched CVE-2026-44244 in the rootio-GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-44243 CVE-2026-44243 in rootio-GitPython - Patched by Root
Root has patched CVE-2026-44243 in the rootio-GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-42284 CVE-2026-42284 in rootio-GitPython - Patched by Root
Root has patched CVE-2026-42284 in the rootio-GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-42215 CVE-2026-42215 in rootio-GitPython - Patched by Root
Root has patched CVE-2026-42215 in the rootio-GitPython package for Root:PyPI. Multiple fixed versions available...
GHSA-94P4-4CQ8-9G67 GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
Summary The fix for GHSA-rwj8-pgh3-r573 stopped Repo.clonefrom from running caller-supplied URLs through os.path.expandvars, but it guarded only that one caller. Remote.create — reached from the public Repo.createremote and its Remote.add alias — still passes an attacker-influenceable URL through...
GHSA-R9MR-M37C-5FR3 GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
Summary GitPython's checkunsafeoptions guard the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since can be bypassed for every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by smuggling an option token inside the VALUE of a single-character...
GHSA-6P8H-3WGX-97GF GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
Summary GitPython's unsafegitcloneoptions denylist omits --template. git clone --template= copies /hooks/ into the new repository and runs them post-checkout fires during clone, so a caller who can influence clone options can achieve arbitrary command execution in the default...
GHSA-FJR4-X663-MWXC GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
Summary Diffable.diff forwards kwargs straight into diff/difftree with no checkunsafeoptions guard. Diffable is mixed into Commit, Tree, IndexFile, and Submodule, giving a broad surface. git diff --output= writes real patch content to an attacker-chosen path, enabling arbitrary file overwrite. Ro...