28 matches found
GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
Summary This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor.fromstring regex-free, but parseactoranddate still runs reactorepoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epoch or timezone i...
GHSA-M64X-33Q8-M5H7 GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
Summary This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor.fromstring regex-free, but parseactoranddate still runs reactorepoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epoch or timezone i...
Incorrect Behavior Order
Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Incorrect Behavior Order via submodule checkout destination validation in git/objects/submodule/base.py. Submodule checkout destinations can pass the containment check...
PT-2026-120814
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.2.1 Description The create submodule function in git/objects/submodule/base.py accepts an attacker-influenced submodule path and invokes clone repo before rejecting the destination. In versions 3.1.x, the validate...
Regular Expression Denial of Service (ReDoS)
Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the reactorepoch pattern in parseactoranddate git/objects/util.py. The pattern ^.+? . \d+ +-\d+.$ allows .+? and . to bo...
Symlink Attack
Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Symlink Attack via Submodule.move in git/objects/submodule/base.py, which validates the destination path only lexically using abspath, commonpath, and relpath, without...
External Control of File Name or Path
Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path via the abspath property in git/objects/submodule/base.py, which lacked the containment check applied to other submodule filesyst...
GitPython submodule update path traversal can write outside the repository
Affected: GitPython 3.1.61 latest release and main — git/objects/submodule/base.py. git diff 3.1.61 origin/main -- git/objects/submodule/ is empty, so both are identical here. --- The gap The fix for GHSA-hmq2-w58f-27jc added Submodule.validatedname and wired it into update and five siblings,...
GHSA-59CR-6R3X-644W GitPython submodule update path traversal can write outside the repository
Affected: GitPython 3.1.61 latest release and main — git/objects/submodule/base.py. git diff 3.1.61 origin/main -- git/objects/submodule/ is empty, so both are identical here. --- The gap The fix for GHSA-hmq2-w58f-27jc added Submodule.validatedname and wired it into update and five siblings,...
Exploit for CVE-2026-38526
Nexus — Local Privilege Escalation PoC Gitea template-sync...
go-git: Malformed Git object data may cause panics or resource exhaustion
Impact Several denial-of-service issues were identified in go-git when parsing maliciously crafted Git repository data. An attacker may craft a malicious .pack, .idx or loose objects that causes an application using an affected version of go-git to panic or consume excessive resources. This can...
CVE-2026-45022
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose...
EUVD-2026-30563
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git...
Incorrect Behavior Order: Validate Before Canonicalize
Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the parsing of Git objects with malformed or ambiguous commit or tag objects. An attacker can cause inconsistent interpretation of object metadata or signature validation by...
SUSE CVE-2025-31130
gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1smol or sha1 crate, both of which implement standard SHA-1 without any mitigations...
CVE-2025-31130 gitoxide does not detect SHA-1 collision attacks
gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1smol or sha1 crate, both of which implement standard SHA-1 without any mitigations...
SHA-1 collision attacks are not detected
Summary gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. Details gitoxide uses the sha1smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct G...
PT-2025-14868
Name of the Vulnerable Software and Affected Versions gitoxide versions prior to 0.42.0 Description The issue arises from gitoxide's use of SHA-1 hash implementations without collision detection, making it vulnerable to hash collision attacks. This means two distinct Git objects with colliding...
