2834 matches found
Arbitrary Argument Injection
Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the fromtree, reset, or mergetree process. An attacker can overwrite or destroy arbitrary files with a valid git-index blob by injecti...
OESA-2026-3249 python-GitPython security update
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through...
PT-2026-78400
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description A remote code execution issue exists in the Repo.init function. The software forwards unsafe git options without proper validation, allowing an attacker to provide a template parameter that points...
PT-2026-78399
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description Insufficient validation of options passed to the git rm and git checkout commands within the IndexFile.remove and Head.checkout functions allows for arbitrary file reading. An attacker can provide...
OPENSUSE-SU-2026:11466-1 python313-GitPython-3.1.58-1.1 on GA media
These are all security issues fixed in the python313-GitPython-3.1.58-1.1 package on the GA media of openSUSE Tumbleweed...
ROOT-APP-PYPI-GHSA-V396-V7Q4-X2QJ GHSA-v396-v7q4-x2qj in GitPython - Patched by Root
Root has patched GHSA-v396-v7q4-x2qj in the GitPython package for Root:PyPI. Multiple fixed versions available...
SUSE CVE-2026-69097
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...
GitPython Repo.clone_from() Unauthorized Access
The vulnerability of the Repo.clonefrom function in the Python library for interacting with Git repositories in GitPython is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...
GitPython Code Execution
The vulnerability of the Git configuration writing module in the Python library for interacting with Git repositories in GitPython is related to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability may allow an attacker to execute arbitrary...
GitPython Repo.clone_from() Code Execution
The vulnerability of the Repo.clonefrom function in the Python library for interacting with Git repositories in GitPython is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code remotely...
GitPython Code Execution
The vulnerability of the checkunsafeoptions function in the Python library for interacting with Git repositories, GitPython, is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability may allow a remote attacker to execute arbitrary code...
PT-2026-76508
Root has patched GHSA-v396-v7q4-x2qj in the GitPython package for Root:PyPI. Multiple fixed versions available...
CLSA-2026-1784077474 TuxCare security update for gitpython (1 CVE)
TuxCare rebuilt gitpython to address 1 CVE. Fixed in 3.1.31.post2+tuxcare...
CLSA-2026-1784077479 TuxCare security update for gitpython (2 CVEs)
TuxCare rebuilt gitpython to address 2 CVEs. Fixed in 3.1.31.post3+tuxcare...
CLSA-2025-1759191117 TuxCare security update for gitpython (1 CVE)
TuxCare rebuilt gitpython to address 1 CVE. Fixed in 3.1.31.post1+tuxcare...
PT-2026-78404
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description GitPython fails to validate submodule names within .gitmodules files. This allows an attacker to use traversal sequences in submodule names during submodule initialization to create Git repositori...
PT-2026-78401
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description An arbitrary file overwrite issue exists in the IndexFile.from tree, IndexFile.reset, and IndexFile.merge tree methods. These methods append caller-influenced treeish strings to the git read-tree...
PT-2026-78402
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description A command execution issue exists in the check unsafe options guard. This guard can be bypassed by combining a single-character kwarg with split single char options=False. An attacker can provide a...