git-vuln-finder

git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...

DEBIAN-CVE-2026-114145

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes clonerepo before safely rejecting the destination. In 3.1.x, validaterepopath does no...

EUVD-2026-107557

GitPython validates a submodule's ".git" path only after cloning into it RCE...

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

Summary createsubmodulename, path, url clones a submodule into the repo's own .git directory before it rejects the path. A path of ".git/hooks" is accepted by the pre-clone check, so the submodule is cloned straight into the live hooks directory, and a file named post-checkout in the submodule...

GHSA-83VG-56QC-22M7 GitPython validates a submodule's ".git" path only after cloning into it (RCE)

Summary createsubmodulename, path, url clones a submodule into the repo's own .git directory before it rejects the path. A path of ".git/hooks" is accepted by the pre-clone check, so the submodule is cloned straight into the live hooks directory, and a file named post-checkout in the submodule...

CVE-2026-114145

A flaw was found in GitPython. This vulnerability allows an attacker to achieve arbitrary code execution by supplying an untrusted submodule path. Because the library fails to properly validate destination paths before cloning repository data, an attacker can plant a malicious executable script...

CVE-2026-114145

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes clonerepo before safely rejecting the destination. In 3.1.x, validaterepopath does no...

CVE-2026-114145 GitPython validates a submodule's ".git" path only after cloning into it (RCE)

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes clonerepo before safely rejecting the destination. In 3.1.x, validaterepopath does no...

CVE-2026-114145

The GitPython Python library is vulnerable to Remote Code Execution (RCE) in versions prior to 3.2.1 . The root cause is that the create_submodule() function in git/objects/submodule/base.py fails to validate an attacker-influenced submodule path (such as .git/hooks) before invoking _clone_repo()...

PT-2026-120814

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.2.1 Description The create submodule function in git/objects/submodule/base.py accepts an attacker-influenced submodule path and invokes clone repo before rejecting the destination. In versions 3.1.x, the validate...

CVE-2026-110858

A flaw was found in GitPython. This vulnerability allows an attacker to achieve arbitrary code execution on the host system. The issue occurs because the Remote.pull function inspects only keyword arguments for unsafe command options and fails to validate positional repository reference...

CLSA-2026-1792479054 TuxCare security update for gitpython (4 CVEs)

TuxCare rebuilt gitpython to address 4 CVEs. Fixed in 3.1.31.post15+tuxcare...

[SECURITY] Fedora 44 Update: GitPython-3.2.1-1.fc44

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...

GitPython-Exploit-CVE-2022-24439

GitPython-Exploit Practical Pentest...

SUSE CVE-2026-110858

GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack= to execute OS commands as the calling process over...

EUVD-2026-101738

GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separategitdir in Repo.clone, which omits expandvars=False when calling Git.polishurl. Attackers can craft a .gitmodules submodule name containing variabl...

EUVD-2026-101741

GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack= to execute OS commands as the calling process over...

EUVD-2026-101742

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

EUVD-2026-101739

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...

EUVD-2026-101740

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...