EUVD-2026-60969

CodeWhale: Project config allowshell override enables arbitrary shell command execution via cloned repository...

CVE-2026-67322

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

CVE-2026-67322

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

CVE-2026-67322 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

Command Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Command Injection via the canonicalizeoptionname function in git/cmd.py. An attacker can execute a local helper command by supplying joined short clone options such as...

GO-2026-4788 In Soft Serve, an authenticated repo import can clone server-local private repositories in github.com/charmbracelet/soft-serve

In Soft Serve, an authenticated repo import can clone server-local private repositories in github.com/charmbracelet/soft-serve...

CVE-2024-53858

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing "git" submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several "gh" comman...