Gitpython Project - vulnerabilities (CVEs)

43 CVEs in 1 products, 6 in the last 30 days, newest from 2026-10-14.

Products

Gitpython - 43 CVEs

Newest CVEs of Gitpython Project

CVE-2026-110860 - CVSS 6.9 (medium), 2026-10-14: GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject…
CVE-2026-110859 - CVSS 8.7 (high), 2026-10-14: GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a…
CVE-2026-110858 - CVSS 9.2 (critical), 2026-10-14: GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments,…
CVE-2026-110857 - CVSS 7.7 (high), 2026-10-14: GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without…
CVE-2026-110856 - CVSS 8.7 (high), 2026-10-14: GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author,…
CVE-2026-110855 - CVSS 7.1 (high), 2026-10-14: GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via…
CVE-2026-100689 - CVSS 8.7 (high), 2026-09-26: GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix…
CVE-2026-87819 - CVSS 8.7 (high), 2026-09-09: GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer…
CVE-2026-87818 - CVSS 7.1 (high), 2026-09-09: GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository…
CVE-2026-87817 - CVSS 8.8 (high), 2026-09-09: GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like…
CVE-2026-78679 - CVSS 7.1 (high), 2026-08-25: GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe…
CVE-2026-78678 - CVSS 7.1 (high), 2026-08-25: GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing…
CVE-2026-78677 - CVSS 8.7 (high), 2026-08-25: GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended…
CVE-2026-78676 - CVSS 9.8 (critical), 2026-08-25: GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected…
CVE-2026-78675 - CVSS 8.6 (high), 2026-08-25: GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary…
CVE-2026-76222 - CVSS 8.4 (high), 2026-08-19: GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths…
CVE-2026-76220 - CVSS 8.8 (high), 2026-08-19: GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character…
CVE-2026-76221 - CVSS 8.8 (high), 2026-08-19: GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config…
CVE-2026-76219 - CVSS 8.1 (high), 2026-08-19: GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods…
CVE-2026-76217 - CVSS 7.1 (high), 2026-08-19: GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can…
CVE-2026-76218 - CVSS 8.8 (high), 2026-08-19: GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply…
CVE-2026-73625 - CVSS 8.8 (high), 2026-08-13: GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options…
CVE-2026-73624 - CVSS 8.1 (high), 2026-08-13: GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed…
CVE-2026-73623 - CVSS 8.8 (high), 2026-08-13: GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command…
CVE-2026-73622 - CVSS 8.7 (high), 2026-08-13: GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate…
CVE-2026-73621 - CVSS 5.4 (medium), 2026-08-13: GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without…
CVE-2026-73620 - CVSS 8.1 (high), 2026-08-13: GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via…
CVE-2026-73619 - CVSS 7.1 (high), 2026-08-13: GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options.…
CVE-2026-69097 - CVSS 7.3 (high), 2026-08-03: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through…
CVE-2026-67324 - CVSS 9.8 (critical), 2026-08-01: GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default…