PT-2026-80703

Root has patched GHSA-hmq2-w58f-27jc in the GitPython package for Root:PyPI. Multiple fixed versions available...

PT-2026-80699

Root has patched GHSA-94p4-4cq8-9g67 in the GitPython package for Root:PyPI. Multiple fixed versions available...

PT-2026-80708

Root has patched GHSA-wvpp-8hx9-p66j in the GitPython package for Root:PyPI. Multiple fixed versions available...

PT-2026-80706

Root has patched GHSA-r9mr-m37c-5fr3 in the GitPython package for Root:PyPI. Multiple fixed versions available...

PT-2026-80704

Root has patched GHSA-jm78-9fvv-mhgr in the GitPython package for Root:PyPI. Multiple fixed versions available...

PT-2026-80693

Root has patched GHSA-3f7w-8rr8-f37f in the GitPython package for Root:PyPI. Multiple fixed versions available...

PT-2026-102781

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen fil...

CVE-2026-73619: External Control of File Name or Path

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

CVE-2026-73620: Improper Limitation of a Pathname to a Restricted Directory

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

CVE-2026-73622: Exposure of Sensitive Information to an Unauthorized Actor

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

PT-2026-80701

Root has patched GHSA-9rj7-rf2p-w77r in the GitPython package for Root:PyPI. Multiple fixed versions available...

PT-2026-80702

Root has patched GHSA-fjr4-x663-mwxc in the GitPython package for Root:PyPI. Multiple fixed versions available...

PT-2026-80694

Root has patched GHSA-3rp5-jjmw-4wv2 in the GitPython package for Root:PyPI. Multiple fixed versions available...

CVE-2026-73621: Improper Neutralization of Argument Delimiters in a Command

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count method, which forwards keyword arguments to 'git rev-list' without the checkunsafeoptions guard present in the sibling iteritems method. An attacker who can control options passed to Commit.count e.g., via an...

CVE-2026-73623: Improper Neutralization of Special Elements used in an OS Command

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

CVE-2026-73624: Improper Neutralization of Argument Delimiters in a Command

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen fil...

CVE-2026-73625: Improper Neutralization of Special Elements used in an OS Command

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

PT-2026-81153

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An incomplete denylist in the unsafe git revision options guard fails to include the --contents and -S options. This allows an attacker to read arbitrary files by passing these options to the...

PT-2026-81150

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An issue exists when parsing .gitmodules files where the software fails to disable merge includes. This allows an attacker to disclose the content of local files by using include directives to poi...

PT-2026-81151

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description GitPython fails to safely re-serialize multi-line git-config values during write operations. This allows attackers to craft configuration files containing embedded newlines that can be corrupted...