2708 matches found
OESA-2026-4026 python-GitPython security update
GitPythonis a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files...
GitPython Command Execution
The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
GitPython Command Injection
The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
GitPython Service Data Access
The vulnerability of the Python library for interacting with git repositories, GitPython, is related to insufficient protection of operational data. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to protected information...
Security update for python-GitPython (important)
openSUSE security update: security update for python-gitpython ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21874-1 Rating: important References: bsc1273357 bsc1273358 bsc1273359 bsc1273364 bsc1273414 bsc1273498 bsc1275745 bsc1275746 bsc1275747...
GitPython: GitPython: Denial of Service via crafted commit author field
A flaw was found in GitPython. A remote attacker could exploit a regular expression denial of service ReDoS vulnerability by crafting a malicious commit object. Specifically, a malformed author field containing an unterminated angle bracket can cause excessive processing, leading to the exhaustio...
gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL
A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clonefrom method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to...
gitpython: GitPython: Command Injection via Git option prefix abbreviation
A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...
gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options
A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...
GitPython: GitPython: Remote Code Execution via Git directory impersonation
A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...
GitPython: GitPython: Denial of Service via crafted commit author field
A flaw was found in GitPython. A remote attacker could exploit a regular expression denial of service ReDoS vulnerability by crafting a malicious commit object. Specifically, a malformed author field containing an unterminated angle bracket can cause excessive processing, leading to the exhaustio...
gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options
A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...
gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL
A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clonefrom method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to...
gitpython: GitPython: Command Injection via Git option prefix abbreviation
A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...
GitPython: GitPython: Arbitrary file read via TagReference.create()
A flaw was found in GitPython. A remote attacker with low privileges can exploit a vulnerability in the TagReference.create function, where a positional reference parameter bypasses a security guard. This allows the attacker to supply a specially crafted reference value, such as --file=, to read...
GitPython: GitPython: Remote Code Execution via Git directory impersonation
A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...
ROOT-APP-PYPI-GHSA-2F96-G7MH-G2HX GHSA-2f96-g7mh-g2hx in GitPython - Patched by Root
Root has patched GHSA-2f96-g7mh-g2hx in the GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-CRMC-F4M7-33FJ GHSA-crmc-f4m7-33fj in GitPython - Patched by Root
Root has patched GHSA-crmc-f4m7-33fj in the GitPython package for Root:PyPI. Multiple fixed versions available...