arca (>=0.1.1, <=0.3.1), epab (>=2018.4.2.1, <=2018.4.2.3) +3 more potentially affected by CVE-2026-73619 via gitpython (2.1.9)

gitpython PYPI version 2.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.1, =2018.4.2.1, =1.0.3, =0.0.0, =0.4.1 - ubuntudesign-documentation-builder 1.6.0 Source cves: CVE-2026-73619 Source advisory:...

airflow-indexima (>=1.0.1, <=2.2.1), arcli (>=0.1.0, <=0.1.1) +69 more potentially affected by CVE-2026-73619 via gitpython (2.1.15)

gitpython PYPI version 2.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - airflow-indexima =1.0.1, =0.1.0, =0.3.0rc1, =0.1.0, =0.7.0, =0.2.0, =0.11.0, =0.1.0, =0.6.0, =0.3.0, =2.0.0, =2019.2.3rc0, =2021.7.0 and more...

GHSA-539M-9XH6-Q6RR GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()

Target: gitpython-developers/GitPython Tested: HEAD 07e80555 2026-07-25, latest release 3.1.55, git version 2.50.1 Summary Repo.archive does call the option guard, so this is not a missing-guard report. The guard is present and working; the denylist it consults is incomplete. python...

gpopt (>=0.1.0, <=0.2.3) potentially affected by CVE-2026-73619 via gitpython (0.3.6)

gitpython PYPI version 0.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - gpopt =0.1.0, =0.2.3 Source cves: CVE-2026-73619 Source advisory: OSV:GHSA-539M-9XH6-Q6RR...

arca (>=0.1.0a0, <=0.1.0), mali (>=0.2775.0, <=0.4018.0) +4 more potentially affected by CVE-2026-73619 via gitpython (2.1.7)

gitpython PYPI version 2.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.0a0, =0.2775.0, =0.2304.0, =0.2304.0, =0.1.0a1, =1.0.0, =1.0.6 Source cves: CVE-2026-73619 Source advisory: OSV:GHSA-539M-9XH6-Q6RR...

codev (>=0.5.1a10, <=0.7.4a3), git-repo (1.6.0) potentially affected by CVE-2026-73619 via gitpython (2.0.2)

gitpython PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - codev =0.5.1a10, =0.7.4a3 - git-repo 1.6.0 Source cves: CVE-2026-73619 Source advisory: OSV:GHSA-539M-9XH6-Q6RR...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +770 more potentially affected by CVE-2026-73619 via gitpython (>=3.0.0, <=3.1.55)

gitpython PYPI version =3.0.0, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-73619 Source advisory: OSV:GHSA-539M-9XH6-Q6RR...

freedom (>=0.0.0_21_g3038804_dirty, <=0.0.1) potentially affected by CVE-2026-73619 via gitpython (0.3.4)

gitpython PYPI version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - freedom =0.0.021g3038804dirty, =0.0.1 Source cves: CVE-2026-73619 Source advisory: OSV:GHSA-539M-9XH6-Q6RR...

aws-client (>=0.10.0, <=0.11.0), git-repo (>=1.7.0, <=1.7.1) potentially affected by CVE-2026-73619 via gitpython (2.0.6)

gitpython PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - aws-client =0.10.0, =1.7.0, =1.7.1 Source cves: CVE-2026-73619 Source advisory: OSV:GHSA-539M-9XH6-Q6RR...

django-l10n-extensions (>=1.0.1, <=1.1.0), django-l10n-extensions-django-3 (1.0.7) +9 more potentially affected by CVE-2026-73619 via gitpython (1.0.1)

gitpython PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - django-l10n-extensions =1.0.1, =0.1.0, =0.1.0, =0.1.0.dev20160122122211, =0.3.0, =0.3.1, =0.1.0, =0.0.0, =0.1.2, =0.1.18 Source cves:...

elib (>=0.1.55, <=0.1.57), emiz (>=0.1.35, <=2018.4.2.1) +11 more potentially affected by CVE-2026-73619 via gitpython (2.1.8)

gitpython PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - elib =0.1.55, =0.1.35, =0.2.4a149, =0.0.1, =1.0.0, =0.4233.0, =0.2354.0, =0.2354.0, =0.1.7, =0.2.120, =1.0.0, =0.1.0, =2.1.1 Source cves:...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-73619 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-73619 Source advisory: OSV:GHSA-539M-9XH6-Q6RR...

bento-cli (>=0.1.0, <=0.1.1), walletlib (0.1.0) potentially affected by CVE-2026-73619 via gitpython (2.1.14)

gitpython PYPI version 2.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bento-cli =0.1.0, =0.1.1 - walletlib 0.1.0 Source cves: CVE-2026-73619 Source advisory: OSV:GHSA-539M-9XH6-Q6RR...

dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2026-73619 via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2026-73619 Source advisory: OSV:GHSA-539M-9XH6-Q6RR...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +770 more potentially affected by CVE-2026-73619 via gitpython (>=3.0.0, <=3.1.55)

gitpython PYPI version =3.0.0, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-73619 Source advisory: SNYK:PYTHON-GITPYTHON-18516649...

git-semver (>=0.1.2, <=0.1.5) potentially affected by CVE-2026-73619 via gitpython (2.0.9)

gitpython PYPI version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - git-semver =0.1.2, =0.1.5 Source cves: CVE-2026-73619 Source advisory: OSV:GHSA-539M-9XH6-Q6RR...

External Control of File Name or Path

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path in the Repo.archive. An attacker can access arbitrary files on the filesystem by supplying specially crafted options that are not...

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

Target: gitpython-developers/GitPython Tested: HEAD 07e80555 2026-07-25, latest release 3.1.55, git version 2.50.1 Reported instances: 2 exploitable, from a sweep of 14 unguarded call sites Summary GitPython blocks dangerous git options through Git.checkunsafeoptions, gated per method by an...

GHSA-3F7W-8RR8-F37F GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

Target: gitpython-developers/GitPython Tested: HEAD 07e80555 2026-07-25, latest release 3.1.55, git version 2.50.1 Reported instances: 2 exploitable, from a sweep of 14 unguarded call sites Summary GitPython blocks dangerous git options through Git.checkunsafeoptions, gated per method by an...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +770 more potentially affected by unknown CVE via gitpython (>=3.0.0, <=3.1.55)

gitpython PYPI version =3.0.0, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: unknown CVE Source advisory: GHSA-3F7W-8RR8-F37F...