GHSA-XP7J-H7JC-4W8P Semaphore U: OS Command Injection

Summary An OS command injection in repository giturl handling lets any user holding the Manager or Owner role on any project the normal project-collaborator roles achieve remote code execution on the Semaphore server host. Using git's --upload-pack= option, an attacker runs arbitrary commands. Th...

EUVD-2026-66708

Gitea: Remote Code Execution via diffpatch Git Hook Installation...

GHSA-RCR6-4JQH-J84M Gitea: Remote Code Execution via diffpatch Git Hook Installation

Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...

Gitea: Remote Code Execution via diffpatch Git Hook Installation

Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues: CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution bsc1276981. CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage...

SUSE-SU-2026:4082-1 Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues: - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution bsc1276981. - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage...

SUSE-SU-2026:4072-1 Security update for python-GitPython

This update for python-GitPython fixes the following issues: - CVE-2026-42215: command injection via Git options bypass bsc1264604. - CVE-2026-42284: unsafe option check validates multioptions before shlex.split transforms it bsc1264605. - CVE-2026-44243: path traversal in GitPython reference API...

Important: Red Hat Security Advisory: git-lfs security update

An update for git-lfs is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CLEANSTART-2026-XC26421 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the git-lfs package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

[SECURITY] Fedora 43 Update: GitPython-3.1.61-1.fc43

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...

Gitea: Remote Code Execution via diffpatch Git Hook Installation

Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can obtain th...

ROS-20260908-73-0094

The vulnerability of the GitConfigParser.read function in the git/config.py module of the Python library for interacting with Git repositories in GitPython is related to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to execute arbitra...

PT-2026-88512

Impact The Git node's clone operation matched the destination path against the default N8N BLOCK FILE PATTERNS expression, which was written so that a crafted path caused catastrophic backtracking. Evaluation runs synchronously in the main n8n process, so an authenticated user could freeze the...

PT-2026-88504

Impact The Git node validated the repository that a fetch or pull targeted, but setUpstream wrote a branch..remote value into the repository's own configuration without validating it. A subsequent fetch or pull resolved the remote from that configuration rather than from the checked parameter, so...

CVE-2026-86995: External Control of File Name or Path

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote...

CVE-2026-86081: Inefficient Regular Expression Complexity

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8NBLOCKFILEPATTERNS regular expression. The pattern ^./.git/.$ allowed catastrophic backtracking and ran...

OPENSUSE-SU-2026:11717-1 git-bug-0.10.1-7.1 on GA media

These are all security issues fixed in the git-bug-0.10.1-7.1 package on the GA media of openSUSE Tumbleweed...

gh-2.100.0-1.1 on GA media (moderate)

gh-2.100.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11698-1 Rating: moderate Cross-References: CVE-2026-56855 CVSS scores: CVE-2026-56855 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-56855 SUSE : 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

NewStart CGSL MAIN 7.02 : git Vulnerability (NS-SA-2026-0105)

The remote NewStart CGSL host, running version MAIN 7.02, has git packages installed that are affected by a vulnerability: - Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When...

ROS-20260908-73-0093

The vulnerability of the Repo.clonefrom and Repo.clone functions in the git/repo/base.py module of the GitPython library for interacting with Git repositories is related to an incorrect path name limitation when processing the --separate-git-dir parameter. Exploiting this vulnerability could allo...