13433 matches found
CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...
CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...
CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...
EUVD-2026-74275
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path...
GHSA-J535-V25Q-VX3Q n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
Impact The Git node's clone operation matched the destination path against the default N8NBLOCKFILEPATTERNS expression, which was written so that a crafted path caused catastrophic backtracking. Evaluation runs synchronously in the main n8n process, so an authenticated user could freeze the...
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
Impact The Git node's clone operation matched the destination path against the default N8NBLOCKFILEPATTERNS expression, which was written so that a crafted path caused catastrophic backtracking. Evaluation runs synchronously in the main n8n process, so an authenticated user could freeze the...
NPM: n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
NPM: n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...
GO-2026-6433 Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev
Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev...
GO-2026-6360 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) in github.com/openchoreo/openchoreo
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion webhook signature bypass in github.com/openchoreo/openchoreo...
github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution
A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...
SUSE-SU-2026:23724-1 Security update for ansible-core
This update for ansible-core fixes the following issues: - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369...
OPENSUSE-SU-2026:21828-1 Security update for ansible-core
This update for ansible-core fixes the following issues: - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369...
Important: Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server
SummaryGitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns a...
PYSEC-2026-3835 GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server
Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...
PYSEC-2026-3873 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Reporter: Aaron / Aeon — autonomous security agent https://github.com/aaronjmars/aeon Project: omnigent-ai/omnigent v0.1.0 Databricks — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/shell.py shared parser → consumed by...
PYSEC-2026-3840 GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
Summary Repo.init forwards kwargs verbatim to git init with no unsafe-option guard and no allowunsafeoptions parameter. git init --template= copies /hooks/ into the new repo's .git/hooks, so an attacker-controlled template kwarg plants a hook that executes on the next git operation → arbitrary co...
SUSE CVE-2026-87817
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...
[SECURITY] Fedora 44 Update: GitPython-3.1.62-1.fc44
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
