ALSA-2026:66364 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

CVE-2026-89011: Improperly Controlled Modification of Object Prototype Attributes

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

CVE-2025-24890

creationtimestamp| type| source ---|---|--- 2026-09-09 18:36:44+00:00| published-proof-of-concept| https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc...

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...

GHSA-HR3M-4QWQ-3MGC GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...

CVE-2026-87817

A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...

Regular Expression Denial of Service (ReDoS)

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the Actor.fromstring parsing in git/util.py. An attacker can exhaust CPU and stall commit metadata access by supplying a...

Duplicate Advisory: Repository content can impersonate the git directory, leading to arbitrary code execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-239g-whfq-7xj9. This link is maintained to preserve external references. Original Description GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the...

django-l10n-extensions (>=1.0.1, <=1.1.0), django-l10n-extensions-django-3 (1.0.7) +9 more potentially affected by CVE-2026-87819 via gitpython (1.0.1)

gitpython PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - django-l10n-extensions =1.0.1, =0.1.0, =0.1.0, =0.1.0.dev20160122122211, =0.3.0, =0.3.1, =0.1.0, =0.0.0, =0.1.2, =0.1.18 Source cves:...

dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2026-87819 via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2026-87819 Source advisory: OSV:PYSEC-2026-3984...

codev (>=0.5.1a10, <=0.7.4a3), git-repo (1.6.0) potentially affected by CVE-2026-87819 via gitpython (2.0.2)

gitpython PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - codev =0.5.1a10, =0.7.4a3 - git-repo 1.6.0 Source cves: CVE-2026-87819 Source advisory: OSV:PYSEC-2026-3984...

aws-client (>=0.10.0, <=0.11.0), git-repo (>=1.7.0, <=1.7.1) potentially affected by CVE-2026-87819 via gitpython (2.0.6)

gitpython PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - aws-client =0.10.0, =1.7.0, =1.7.1 Source cves: CVE-2026-87819 Source advisory: OSV:PYSEC-2026-3984...

git-semver (>=0.1.2, <=0.1.5) potentially affected by CVE-2026-87819 via gitpython (2.0.9)

gitpython PYPI version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - git-semver =0.1.2, =0.1.5 Source cves: CVE-2026-87819 Source advisory: OSV:PYSEC-2026-3984...

dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2026-87817 via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2026-87817 Source advisory: OSV:PYSEC-2026-3982...

codev (>=0.5.1a10, <=0.7.4a3), git-repo (1.6.0) potentially affected by CVE-2026-87817 via gitpython (2.0.2)

gitpython PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - codev =0.5.1a10, =0.7.4a3 - git-repo 1.6.0 Source cves: CVE-2026-87817 Source advisory: OSV:PYSEC-2026-3982...

aws-client (>=0.10.0, <=0.11.0), git-repo (>=1.7.0, <=1.7.1) potentially affected by CVE-2026-87817 via gitpython (2.0.6)

gitpython PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - aws-client =0.10.0, =1.7.0, =1.7.1 Source cves: CVE-2026-87817 Source advisory: OSV:PYSEC-2026-3982...

git-semver (>=0.1.2, <=0.1.5) potentially affected by CVE-2026-87817 via gitpython (2.0.9)

gitpython PYPI version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - git-semver =0.1.2, =0.1.5 Source cves: CVE-2026-87817 Source advisory: OSV:PYSEC-2026-3982...