2967 matches found
CVE-2026-76218: Improper Neutralization of Argument Delimiters in a Command
GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...
CVE-2026-76217: External Control of File Name or Path
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...
CVE-2026-76221: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...
CVE-2026-76221: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...
CVE-2026-76219: Improper Neutralization of Argument Delimiters in a Command
GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the...
CVE-2026-76222: Improper Limitation of a Pathname to a Restricted Directory
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython...
CVE-2026-76220: Improper Neutralization of Argument Delimiters in a Command
GitPython before 3.1.58 contains a command execution vulnerability in the checkunsafeoptions guard that can be bypassed by combining a single-character kwarg with splitsinglecharoptions=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clonefrom to emit a joined toke...
CVE-2026-76218: Improper Neutralization of Argument Delimiters in a Command
GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...
CVE-2026-76217: External Control of File Name or Path
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...
CVE-2026-76219: Improper Neutralization of Argument Delimiters in a Command
GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the...
PT-2026-85179
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython...
Fedora 44 : GitPython (2026-166bfc4f18)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-166bfc4f18 advisory. Update to 3.1.59 close RHBZ2499503 - Fixes GHSA-5xxx-qhh7-9287, GHSA-3wxw-xv34-2frg, GHSA-8mcc-hrx5-hvxc, GHSA-284h-m62q-gf8w, GHSA-7833-fr7j-v32q,...
CVE-2026-76222: Improper Limitation of a Pathname to a Restricted Directory
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython...
Exploit for Improper Input Validation in Gitpython_Project Gitpython
No d...
CLSA-2026-1787042950 TuxCare security update for gitpython (1 CVE)
TuxCare rebuilt gitpython to address 1 CVE. Fixed in 3.1.31.post6+tuxcare...
CLSA-2026-1787036379 TuxCare security update for gitpython (1 CVE)
TuxCare rebuilt gitpython to address 1 CVE. Fixed in 3.1.31.post5+tuxcare...
CLSA-2026-1787028613 TuxCare security update for gitpython (5 CVEs)
TuxCare rebuilt gitpython to address 5 CVEs. Fixed in 3.1.31.post4+tuxcare...
PT-2026-83031
TuxCare rebuilt gitpython to address 4 CVEs. Fixed in 3.1.31.post4+tuxcare...