CVE-2026-53980

Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware charm.land/wish/v2 that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in...

CVE-2026-53980

Charmbracelet wish versions prior to 2.0.5 are vulnerable to a path traversal flaw within the git.Middleware() component. The root cause is a flawed forward-slash-count containment check that can be bypassed using crafted repo paths. Authenticated SSH users can exploit this to escape the configur...

EUVD-2026-118276

Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware charm.land/wish/v2 that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in...

CVE-2026-53980 Charmbracelet Wish 2.0.5 Path Traversal via git Middleware

Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware charm.land/wish/v2 that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in...

CVE-2026-53980 Charmbracelet Wish 2.0.5 Path Traversal via git Middleware

Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware charm.land/wish/v2 that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in...

CVE-2026-53980 Charmbracelet Wish 2.0.5 Path Traversal via git Middleware

Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware charm.land/wish/v2 that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in...

CVE-2026-53980: charmbracelet wish: Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that…

Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware charm.land/wish/v2 that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in...

Exploit for Improper Encoding or Escaping of Output in Gitea

Gitea CVE-2022-30781 RCE Proof of Concept ███████╗███████╗███...

Path Traversal

Apache MINA SSHD bundle sshd-git is vulnerable to path traversal. The vulnerability is due to lack of path validation in git-upload-pack, git-receive-pack, and other git operations, where authenticated SSH users can access git repositories outside the configured server root directory, allowing th...

Linux Distros Unpatched Vulnerability : CVE-2026-110858

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull whose unsafe-option guard inspects only keyword arguments, not...

CVE-2026-110858

GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack= to execute OS commands as the calling process over...

CVE-2026-110858

GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack= to execute OS commands as the calling process over...

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

SummaryThe checkunsafeoptions guard can be bypassed on every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by combining a single-character kwarg with splitsinglecharoptions=False. The guard's candidate list omits the smuggled option, but transformkwarg emi...

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

SummaryGitPython already know that --upload-pack / --exec are command-exec vectors, they are denylist ingit/remote.py:535 and check by Git.checkunsafeoptions git/cmd.py:963, the thing is thischeck him he is only call from fetch, pull, push and clonefrom, everything else who build a gitargv from...

GHSA-XP7J-H7JC-4W8P Semaphore U: OS Command Injection

Summary An OS command injection in repository giturl handling lets any user holding the Manager or Owner role on any project the normal project-collaborator roles achieve remote code execution on the Semaphore server host. Using git's --upload-pack= option, an attacker runs arbitrary commands. Th...

Semaphore U: OS Command Injection

Summary An OS command injection in repository giturl handling lets any user holding the Manager or Owner role on any project the normal project-collaborator roles achieve remote code execution on the Semaphore server host. Using git's --upload-pack= option, an attacker runs arbitrary commands. Th...

EUVD-2026-57320

Semaphore U: OS Command Injection...

SUSE CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

CVE-2026-76220

GitPython before 3.1.58 contains a command execution vulnerability in the checkunsafeoptions guard that can be bypassed by combining a single-character kwarg with splitsinglecharoptions=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clonefrom to emit a joined toke...

CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...