{"id":"CVE-2026-87817","aliases":["CLSA-2026-1790833527","DEBIAN-CVE-2026-87817","EUVD-2026-74843","GHSA-239g-whfq-7xj9","GHSA-2pxq-5vcg-rq29","GHSA-59cr-6r3x-644w","OESA-2026-4025","OESA-2026-4026","OESA-2026-4027","PYSEC-2026-3982","RHSA-2026:71113","RHSA-2026:71114","RHSA-2026:74503","RHSA-2026:74504","RHSA-2026:74505","RHSA-2026:74506","SUSE-SU-2026:4191-1","UBUNTU-CVE-2026-87817","openSUSE-SU-2026:21874-1"],"status":"published","title":"GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation","description":"GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00419,"percentile":0.36707,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-427","CWE-94"],"published":"2026-09-09T11:21:04Z","modified":"2026-10-31T14:00:10Z","fixes":[{"ecosystem":"PyPI","package":"gitpython","fixed_in":["3.1.60"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-git","fixed_in":["3.1.30-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-git","fixed_in":["3.1.44-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-git","fixed_in":["3.1.61-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.59"},{"fixed":"3.1.60"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.31"},{"fixed":"3.1.31.post14+tuxcare"}]}],"versions":["3.1.31","3.1.31.post1+tuxcare","3.1.31.post10+tuxcare","3.1.31.post11+tuxcare","3.1.31.post12+tuxcare","3.1.31.post13+tuxcare","3.1.31.post2+tuxcare","3.1.31.post3+tuxcare","3.1.31.post4+tuxcare","3.1.31.post5+tuxcare","3.1.31.post6+tuxcare","3.1.31.post7+tuxcare","3.1.31.post8+tuxcare","3.1.31.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.30-1+deb12u3"}]}],"versions":["3.1.30-1","3.1.30-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.44-1+deb13u1"}]}],"versions":["3.1.44-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.61-1"}]}],"versions":["3.1.44-1","3.1.45-1","3.1.46-1","3.1.50-1"]},{"source":"osv","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.60"}]}],"versions":["0.1.7","0.2.0-beta1","0.3.0-beta1","0.3.0-beta2","0.3.1-beta2","0.3.2","0.3.2.1","0.3.2.RC1","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","1.0.0","1.0.1","1.0.2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0.9.dev0","2.0.9.dev1","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.22","3.1.23","3.1.24","3.1.25","3.1.26","3.1.27","3.1.28","3.1.29","3.1.3","3.1.30","3.1.31","3.1.32","3.1.33","3.1.34","3.1.35","3.1.36","3.1.37","3.1.38","3.1.4","3.1.40","3.1.41","3.1.42","3.1.43","3.1.44","3.1.45","3.1.46","3.1.47","3.1.48","3.1.49","3.1.5","3.1.50","3.1.51","3.1.52","3.1.53","3.1.54","3.1.55","3.1.56","3.1.57","3.1.58","3.1.59","3.1.6","3.1.7","3.1.8","3.1.9"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.59-2.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.59-2.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.59-2.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.60"}]}],"versions":["0.1.7","0.2.0-beta1","0.3.0-beta1","0.3.0-beta2","0.3.1-beta2","0.3.2","0.3.2.1","0.3.2.RC1","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","1.0.0","1.0.1","1.0.2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0.9.dev0","2.0.9.dev1","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.22","3.1.23","3.1.24","3.1.25","3.1.26","3.1.27","3.1.28","3.1.29","3.1.3","3.1.30","3.1.31","3.1.32","3.1.33","3.1.34","3.1.35","3.1.36","3.1.37","3.1.38","3.1.4","3.1.40","3.1.41","3.1.42","3.1.43","3.1.44","3.1.45","3.1.46","3.1.47","3.1.48","3.1.49","3.1.5","3.1.50","3.1.51","3.1.52","3.1.53","3.1.54","3.1.55","3.1.56","3.1.57","3.1.58","3.1.59","3.1.6","3.1.7","3.1.8","3.1.9"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-3.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"python3-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"python3-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.60-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.33-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.33-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-8.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-3.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260923-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260923-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.60-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.60-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.5.3-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.5.3-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-2.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-2.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.20.0.11-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.2.3-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.2.3-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-2.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-2.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"pulpcore-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-6.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"pulpcore-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-6.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0.24-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.2-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.2-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0.20-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34.1693646983.2a2ae77-150400.9.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.2~RC1-2","0.3.2~RC1-3","0.3.2~RC1-3ubuntu0.1~esm1","0.3.2~RC1-3ubuntu0.1~esm2","0.3.2~RC1-3ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1+git137-gc8b8379-1","1.0.1+git137-gc8b8379-2","1.0.1+git137-gc8b8379-2.1","1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1","1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2","1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.5-1","2.1.6-1","2.1.7-1","2.1.8-1","2.1.8-1ubuntu0.1~esm1","2.1.8-1ubuntu0.1~esm2","2.1.8-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.11-1","3.0.4-1","3.0.5-1","3.0.7-1","3.0.7-1ubuntu0.1~esm1","3.0.7-1ubuntu0.1~esm2","3.0.7-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.14-1","3.1.23-1","3.1.24-1","3.1.24-1ubuntu0.1~esm1","3.1.24-1ubuntu0.1~esm2","3.1.24-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.30-1","3.1.37-1","3.1.37-3","3.1.37-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.44-1","3.1.45-1","3.1.46-1","3.1.46-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.44-160000.4.1"}]}],"bundled":26}],"products":[{"vendor":"gitpython-developers","product":"gitpython"},{"vendor":"gitpython_project","product":"gitpython"}],"references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9","tags":["vendor-advisory","Exploit","Mitigation","Vendor Advisory","advisory","web","evidence","article","report"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation","tags":["third-party-advisory","Third Party Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87817","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/pull/2218","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b","tags":["web"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3982.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-239g-whfq-7xj9"},{"url":"https://github.com/advisories/GHSA-2pxq-5vcg-rq29"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87817.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-87817","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4025","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87819","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4026","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4027","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71113","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490556","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508411","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515840","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527073","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527100","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527118","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527140","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530744","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71113.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12564","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54284","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/939b129e24c0ad5d51368b1aa72fffcaca76f06f","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://go.dev/cl/803320","tags":["article"]},{"url":"https://go.dev/issue/80481","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59893","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59893","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67214","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67214","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.16","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67322","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67323","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67323","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71458","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71458","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71459","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71459","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71459","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71460","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71460","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71462","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71462","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71462","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71463","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71463","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71463","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71464","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71464","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71465","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71465","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71491","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71491","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73086","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/3.3.12","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.11","tags":["article"]},{"url":"https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75838","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75838","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75884","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75884","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/pull/797","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.2","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.2","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84470","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84470","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84470","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84474","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84474","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84474","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84486","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84486","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84486","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84499","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84502","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84638","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84638","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84643","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84643","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84644","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84644","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84644","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84679","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84680","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84680","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84683","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84683","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84684","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84686","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84686","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84689","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84689","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84691","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84691","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84703","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84703","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84703","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84706","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84706","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84706","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84707","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84707","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84707","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84708","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84708","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84709","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84709","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84709","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84711","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84711","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84712","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84714","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84714","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84716","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84716","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84717","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84718","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84718","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84718","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84719","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84719","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84719","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84720","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84720","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84724","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84724","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87817","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87819","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530742","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87819","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527121","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71114.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84678","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74503","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-50183","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50184","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50185","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50187","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50584","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50904","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74503.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488952","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12405","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12423","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12423","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12540","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489969","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12540","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489970","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12541","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489971","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12542","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489992","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12544","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12545","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449774","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33154","tags":["advisory"]},{"url":"https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7","tags":["article"]},{"url":"https://github.com/dynaconf/dynaconf/releases/tag/3.2.13","tags":["article"]},{"url":"https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490543","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56097","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490542","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56098","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59879","tags":["advisory"]},{"url":"https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84","tags":["article"]},{"url":"https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a","tags":["article"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9","tags":["article"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8","tags":["article"]},{"url":"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521778","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75899","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75931","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75931","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75975","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75975","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-79654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523348","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79654","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79654","tags":["advisory"]},{"url":"https://github.com/Katello/katello/pull/11847","tags":["article"]},{"url":"https://projects.theforeman.org/issues/39701","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84292","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84292","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527756","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84394","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534185","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96658","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536844","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96659","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74504","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467802","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-50952","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50953","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74504.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42215","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42215","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42284","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74505","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520368","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-50544","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50545","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74505.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49825","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49825","tags":["advisory"]},{"url":"https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2","tags":["article"]},{"url":"https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5","tags":["article"]},{"url":"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f","tags":["article"]},{"url":"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0","tags":["article"]},{"url":"https://github.com/lxml/lxml/releases/tag/lxml-6.1.1","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73620","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73620","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73622","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73622","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73622","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73623","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73624","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73624","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73624","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73625","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73625","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74506","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74506.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264191-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1279905","tags":["report"]},{"url":"https://bugzilla.suse.com/1279906","tags":["report"]},{"url":"https://bugzilla.suse.com/1279907","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87819","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-87817","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273357","tags":["report"]},{"url":"https://bugzilla.suse.com/1273358","tags":["report"]},{"url":"https://bugzilla.suse.com/1273359","tags":["report"]},{"url":"https://bugzilla.suse.com/1273364","tags":["report"]},{"url":"https://bugzilla.suse.com/1273414","tags":["report"]},{"url":"https://bugzilla.suse.com/1273498","tags":["report"]},{"url":"https://bugzilla.suse.com/1275745","tags":["report"]},{"url":"https://bugzilla.suse.com/1275746","tags":["report"]},{"url":"https://bugzilla.suse.com/1275747","tags":["report"]},{"url":"https://bugzilla.suse.com/1275748","tags":["report"]},{"url":"https://bugzilla.suse.com/1275749","tags":["report"]},{"url":"https://bugzilla.suse.com/1275750","tags":["report"]},{"url":"https://bugzilla.suse.com/1275751","tags":["report"]},{"url":"https://bugzilla.suse.com/1275752","tags":["report"]},{"url":"https://bugzilla.suse.com/1275753","tags":["report"]},{"url":"https://bugzilla.suse.com/1275754","tags":["report"]},{"url":"https://bugzilla.suse.com/1275755","tags":["report"]},{"url":"https://bugzilla.suse.com/1275756","tags":["report"]},{"url":"https://bugzilla.suse.com/1275757","tags":["report"]},{"url":"https://bugzilla.suse.com/1276430","tags":["report"]},{"url":"https://bugzilla.suse.com/1276431","tags":["report"]},{"url":"https://bugzilla.suse.com/1276432","tags":["report"]},{"url":"https://bugzilla.suse.com/1276433","tags":["report"]},{"url":"https://bugzilla.suse.com/1276434","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78679","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-87817","title":"GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation","description":"GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","status":"published","published":"2026-09-09T11:21:04.007Z","modified":"2026-10-08T15:25:56.195Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T13:37:47.463822Z"}],"euvd":[{"id":"EUVD-2026-74843","description":"GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","status":"published","published":"2026-09-09T11:21:04Z","modified":"2026-10-08T15:25:56Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:28.564399Z"}],"ghsa":[{"id":"GHSA-239g-whfq-7xj9","title":"GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution","description":"### Summary\n\n`Repo.__init__` decides which directory is the git directory by testing candidate paths in an order that\nconsiders the real `.git` **last**. Two earlier tests can be satisfied by ordinary tracked files. Git\nreserves only the literal name `.git`, so `HEAD`, `objects/`, `refs/`, `config`, `gitdir`, `commondir`\nand `hooks/` at a repository root are all legal tracked content.\n\nConsequently, after a victim opens or clones an attacker's repository, GitPython resolves `git_dir` to\nthe **working-tree root** while real git correctly resolves `\u003croot\u003e/.git`. Everything GitPython then\ntreats as \"inside the git directory\" is attacker-authored content — including `hooks/`, which it\nexecutes.\n\n### CVE-2026-87817\n\n### Affected code (3.1.59)\n\nThe discovery loop in `git/repo/base.py` tests, in order:\n\n1. `git/repo/base.py:299` — `isfile(curpath/gitdir)` **and** `isfile(curpath/commondir)` **and** `isfile(curpath/HEAD)`\n2. `git/repo/base.py:320` — `is_git_dir(curpath)`\n3. `git/repo/base.py:341` — `dotgit = osp.join(curpath, \".git\")` ← the real git dir, considered last\n\n`is_git_dir` (`git/repo/fun.py:60`) requires only that `objects/` and `refs/` are directories and that\n`HEAD` is a file; **`HEAD`'s contents are never parsed.** The hook path is resolved from\n`index.repo.git_dir` (`git/index/fun.py:73`), i.e. the mis-resolved directory.\n\n### Proof of concept\n\nRequires only `pip install GitPython==3.1.59`. Full script attached as `poc1_rce.py`; it runs entirely\nin a temp directory and the payload only writes a marker file.\n\nAttacker repository — four ordinary tracked files at the root:\n\n| path | mode | content |\n|---|---|---|\n| `gitdir` | 100644 | `.git\\n` |\n| `commondir` | 100644 | `.git\\n` |\n| `HEAD` | 100644 | `ref: refs/heads/master\\n` |\n| `hooks/pre-commit` | **100755** | `#!/bin/sh` + payload |\n\nVictim — two ordinary calls:\n\n```python\nrepo = git.Repo.clone_from(url, dst)     # or git.Repo(dst)\nrepo.index.commit(\"automated commit\")    # code execution happens here\n```\n\nObserved on the PyPI release 3.1.59 (Linux and Windows):\n\n```\nreal git says the git dir is : /tmp/.../victim/.git\nGitPython says it is         : /tmp/.../victim      \u003c- shadowed\nattacker's hook executed     : True\ngit fsck                     : (clean)\n```\n\nThe `pre-commit` hook runs at `git/index/base.py:1201`, before `write_tree()`, so it fires even though\nthe commit later fails.\n\n### Impact\n\nA service that opens or clones an untrusted repository with GitPython — a CI runner building a fork\npull request, a code-scanning/SBOM service, a mirror, a dependency bot, an AI code-review/agent tool —\ncan be made to:\n\n1. **Execute arbitrary commands** via the tracked `\u003croot\u003e/hooks/pre-commit` when the victim calls\n   `index.commit()`.\n2. **Read files outside the repository**: the tracked `\u003croot\u003e/config` becomes the repository config and\n   is parsed with `merge_includes=True` (`git/repo/base.py:765`), so `[include] path = ~/.aws/credentials`\n   discloses the file. (`Repo._config_reader` still defaults `merge_includes=True`, so the hardening\n   added in 3.1.59 for `.gitmodules`/GHSA-7833 does not cover this path.)\n3. **Write a config file to an attacker-chosen directory** via an absolute tracked `commondir`.\n\nDelivery is silent: `git clone` exits 0, `git fsck` (including `--strict`, and with\n`transfer.fsckObjects`/`fetch.fsckObjects=true`) reports nothing, and the clone passes every read-only\nprobe (`head.commit`, `branches`, `is_dirty()`, `untracked_files`, `iter_commits`) because a tracked\n`commondir` of `.git` pins `common_dir` to the real `.git`.\n\n### Threat model / preconditions\n\n- Attacker controls the content of a repository the victim opens or clones with GitPython (public repo,\n  fork PR, mirrored dependency).\n- For code execution, the victim performs a commit via GitPython's native `index.commit()`. For the\n  file-read impact, opening the repo and reading config is enough.\n- `GIT_WORK_TREE` is **not** a mitigation — `git_dir` is assigned and the discovery loop breaks before\n  the environment is consulted.\n- Real git is unaffected; only GitPython mis-resolves the directory.\n\n### Remediation\n\n1. Test `curpath/.git` **before** the `gitdir`/`commondir`/`HEAD` triple and before `is_git_dir(curpath)`.\n2. Resolve `hook_path` / `_commit_hook_path` / `_get_validated_reflog_path` through `repo.common_dir`.\n3. Containment-check `commondir`/`gitdir` contents before joining (reuse\n   `SymbolicReference._get_validated_path`).\n4. Validate `HEAD` in `is_git_dir` (require `ref: refs/...` or a 40-hex sha).\n5. Pass `merge_includes=False` in `Repo._config_reader` (`git/repo/base.py:765`).\n\n### Note for the maintainers\n\nCommit `406b98e1` (2026-05-31, \"respect core.hooksPath for commit hooks\") resolved the hook path via\n`git rev-parse --git-path`, which is immune because git rediscovers the true `.git`. Commit `9bc287a2`\n(2026-07-20) reverted it to avoid an unconditional `rev-parse` dependency — reintroducing the exec step.\nMeasured at each commit with the healthy-looking layout: `406b98e1` → hook did not fire; `9bc287a2` …\n`3.1.59` → hook fired.\n\n### Scope note\n\nOnly the **repository-root** case is reported: where a real `.git` exists, git prefers it, and GitPython\ndoes not. A fake git dir in a subdirectory fools real git too, so that variant is out of scope as a\ngeneral ecosystem hazard rather than a GitPython defect.\n\n###POC Files :\n[poc1_rce.py](https://github.com/user-attachments/files/31388464/poc1_rce.py)\n[poc2_file_read.py](https://github.com/user-attachments/files/31388465/poc2_file_read.py)","status":"published","published":"2026-09-30T23:27:59Z","modified":"2026-09-30T23:28:01Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94","CWE-427"],"updated_at":"2026-11-02T14:41:23.783773Z"},{"id":"GHSA-2pxq-5vcg-rq29","title":"Duplicate Advisory: Repository content can impersonate the git directory, leading to arbitrary code execution","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-239g-whfq-7xj9. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","status":"withdrawn","published":"2026-09-09T12:32:15Z","modified":"2026-09-30T23:27:48Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-87817","description":"GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","status":"published","published":"2026-09-09T12:17:16.83Z","modified":"2026-09-16T15:24:41.533Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:45.93749Z"}],"osv":[{"id":"CVE-2026-87817","title":"GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation","description":"GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","status":"published","published":"2026-09-09T11:21:04.007Z","modified":"2026-10-28T02:31:05.663155401Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"DEBIAN-CVE-2026-87817","description":"GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","status":"published","published":"2026-09-09T12:17:16.83Z","modified":"2026-10-31T14:00:10.723092144Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"GHSA-239g-whfq-7xj9","title":"GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution","description":"### Summary\n\n`Repo.__init__` decides which directory is the git directory by testing candidate paths in an order that\nconsiders the real `.git` **last**. Two earlier tests can be satisfied by ordinary tracked files. Git\nreserves only the literal name `.git`, so `HEAD`, `objects/`, `refs/`, `config`, `gitdir`, `commondir`\nand `hooks/` at a repository root are all legal tracked content.\n\nConsequently, after a victim opens or clones an attacker's repository, GitPython resolves `git_dir` to\nthe **working-tree root** while real git correctly resolves `\u003croot\u003e/.git`. Everything GitPython then\ntreats as \"inside the git directory\" is attacker-authored content — including `hooks/`, which it\nexecutes.\n\n### CVE-2026-87817\n\n### Affected code (3.1.59)\n\nThe discovery loop in `git/repo/base.py` tests, in order:\n\n1. `git/repo/base.py:299` — `isfile(curpath/gitdir)` **and** `isfile(curpath/commondir)` **and** `isfile(curpath/HEAD)`\n2. `git/repo/base.py:320` — `is_git_dir(curpath)`\n3. `git/repo/base.py:341` — `dotgit = osp.join(curpath, \".git\")` ← the real git dir, considered last\n\n`is_git_dir` (`git/repo/fun.py:60`) requires only that `objects/` and `refs/` are directories and that\n`HEAD` is a file; **`HEAD`'s contents are never parsed.** The hook path is resolved from\n`index.repo.git_dir` (`git/index/fun.py:73`), i.e. the mis-resolved directory.\n\n### Proof of concept\n\nRequires only `pip install GitPython==3.1.59`. Full script attached as `poc1_rce.py`; it runs entirely\nin a temp directory and the payload only writes a marker file.\n\nAttacker repository — four ordinary tracked files at the root:\n\n| path | mode | content |\n|---|---|---|\n| `gitdir` | 100644 | `.git\\n` |\n| `commondir` | 100644 | `.git\\n` |\n| `HEAD` | 100644 | `ref: refs/heads/master\\n` |\n| `hooks/pre-commit` | **100755** | `#!/bin/sh` + payload |\n\nVictim — two ordinary calls:\n\n```python\nrepo = git.Repo.clone_from(url, dst)     # or git.Repo(dst)\nrepo.index.commit(\"automated commit\")    # code execution happens here\n```\n\nObserved on the PyPI release 3.1.59 (Linux and Windows):\n\n```\nreal git says the git dir is : /tmp/.../victim/.git\nGitPython says it is         : /tmp/.../victim      \u003c- shadowed\nattacker's hook executed     : True\ngit fsck                     : (clean)\n```\n\nThe `pre-commit` hook runs at `git/index/base.py:1201`, before `write_tree()`, so it fires even though\nthe commit later fails.\n\n### Impact\n\nA service that opens or clones an untrusted repository with GitPython — a CI runner building a fork\npull request, a code-scanning/SBOM service, a mirror, a dependency bot, an AI code-review/agent tool —\ncan be made to:\n\n1. **Execute arbitrary commands** via the tracked `\u003croot\u003e/hooks/pre-commit` when the victim calls\n   `index.commit()`.\n2. **Read files outside the repository**: the tracked `\u003croot\u003e/config` becomes the repository config and\n   is parsed with `merge_includes=True` (`git/repo/base.py:765`), so `[include] path = ~/.aws/credentials`\n   discloses the file. (`Repo._config_reader` still defaults `merge_includes=True`, so the hardening\n   added in 3.1.59 for `.gitmodules`/GHSA-7833 does not cover this path.)\n3. **Write a config file to an attacker-chosen directory** via an absolute tracked `commondir`.\n\nDelivery is silent: `git clone` exits 0, `git fsck` (including `--strict`, and with\n`transfer.fsckObjects`/`fetch.fsckObjects=true`) reports nothing, and the clone passes every read-only\nprobe (`head.commit`, `branches`, `is_dirty()`, `untracked_files`, `iter_commits`) because a tracked\n`commondir` of `.git` pins `common_dir` to the real `.git`.\n\n### Threat model / preconditions\n\n- Attacker controls the content of a repository the victim opens or clones with GitPython (public repo,\n  fork PR, mirrored dependency).\n- For code execution, the victim performs a commit via GitPython's native `index.commit()`. For the\n  file-read impact, opening the repo and reading config is enough.\n- `GIT_WORK_TREE` is **not** a mitigation — `git_dir` is assigned and the discovery loop breaks before\n  the environment is consulted.\n- Real git is unaffected; only GitPython mis-resolves the directory.\n\n### Remediation\n\n1. Test `curpath/.git` **before** the `gitdir`/`commondir`/`HEAD` triple and before `is_git_dir(curpath)`.\n2. Resolve `hook_path` / `_commit_hook_path` / `_get_validated_reflog_path` through `repo.common_dir`.\n3. Containment-check `commondir`/`gitdir` contents before joining (reuse\n   `SymbolicReference._get_validated_path`).\n4. Validate `HEAD` in `is_git_dir` (require `ref: refs/...` or a 40-hex sha).\n5. Pass `merge_includes=False` in `Repo._config_reader` (`git/repo/base.py:765`).\n\n### Note for the maintainers\n\nCommit `406b98e1` (2026-05-31, \"respect core.hooksPath for commit hooks\") resolved the hook path via\n`git rev-parse --git-path`, which is immune because git rediscovers the true `.git`. Commit `9bc287a2`\n(2026-07-20) reverted it to avoid an unconditional `rev-parse` dependency — reintroducing the exec step.\nMeasured at each commit with the healthy-looking layout: `406b98e1` → hook did not fire; `9bc287a2` …\n`3.1.59` → hook fired.\n\n### Scope note\n\nOnly the **repository-root** case is reported: where a real `.git` exists, git prefers it, and GitPython\ndoes not. A fake git dir in a subdirectory fools real git too, so that variant is out of scope as a\ngeneral ecosystem hazard rather than a GitPython defect.\n\n###POC Files :\n[poc1_rce.py](https://github.com/user-attachments/files/31388464/poc1_rce.py)\n[poc2_file_read.py](https://github.com/user-attachments/files/31388465/poc2_file_read.py)","status":"published","published":"2026-09-30T23:27:59Z","modified":"2026-09-30T23:45:04.022111787Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427","CWE-94"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"GHSA-2pxq-5vcg-rq29","title":"Duplicate Advisory: Repository content can impersonate the git directory, leading to arbitrary code execution","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-239g-whfq-7xj9. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","status":"withdrawn","published":"2026-09-09T12:32:15Z","modified":"2026-09-30T23:45:04.027320345Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"OESA-2026-4025","title":"python-GitPython security update","description":"**GitPython*is a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files support.With the new object database abstraction added in 0.3, its even possible to implement your own storage mechanisms, the currently available implementations are \u0026amp;apos;cgit\u0026amp;apos; and pure python, which is the default.Documentation The latest documentation can be found here: As this version of GitPython depends on GitDB, which in turn needs smmap to work, installation is a bit more involved if you do a manual installation, instead of using pip.\r\n\r\nSecurity Fix(es):\n\nGitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.(CVE-2026-87817)\n\nGitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.(CVE-2026-87818)\n\nGitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.(CVE-2026-87819)","status":"published","published":"2026-09-25T01:27:26Z","modified":"2026-09-25T01:45:05.595929548Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4026","title":"python-GitPython security update","description":"**GitPython*is a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files support.With the new object database abstraction added in 0.3, its even possible to implement your own storage mechanisms, the currently available implementations are \u0026amp;apos;cgit\u0026amp;apos; and pure python, which is the default.Documentation The latest documentation can be found here: As this version of GitPython depends on GitDB, which in turn needs smmap to work, installation is a bit more involved if you do a manual installation, instead of using pip.\r\n\r\nSecurity Fix(es):\n\nGitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.(CVE-2026-87817)\n\nGitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.(CVE-2026-87818)\n\nGitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.(CVE-2026-87819)","status":"published","published":"2026-09-25T01:27:26Z","modified":"2026-09-25T01:45:04.66251923Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4027","title":"python-GitPython security update","description":"**GitPython*is a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files support.With the new object database abstraction added in 0.3, its even possible to implement your own storage mechanisms, the currently available implementations are \u0026amp;apos;cgit\u0026amp;apos; and pure python, which is the default.Documentation The latest documentation can be found here: As this version of GitPython depends on GitDB, which in turn needs smmap to work, installation is a bit more involved if you do a manual installation, instead of using pip.\r\n\r\nSecurity Fix(es):\n\nGitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.(CVE-2026-87817)\n\nGitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.(CVE-2026-87818)\n\nGitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.(CVE-2026-87819)","status":"published","published":"2026-09-25T01:27:27Z","modified":"2026-09-25T01:45:06.501047866Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"PYSEC-2026-3982","description":"GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","status":"published","published":"2026-09-09T12:17:16.83Z","modified":"2026-09-17T09:00:03.355630821Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:57.255153Z"},{"id":"RHSA-2026:71113","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-09-24T10:15:15Z","modified":"2026-10-20T10:14:50Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:71114","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2026-09-24T10:15:16Z","modified":"2026-10-20T10:14:51Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74503","title":"Red Hat Security Advisory: Satellite 6.19.5 Async Update","status":"published","published":"2026-10-02T10:25:57Z","modified":"2026-10-20T10:15:35Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74504","title":"Red Hat Security Advisory: Satellite 6.18.10 Async Update","status":"published","published":"2026-10-02T10:25:58Z","modified":"2026-10-20T10:15:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74505","title":"Red Hat Security Advisory: Satellite 6.17.12 Async Update","status":"published","published":"2026-10-03T10:16:56Z","modified":"2026-10-20T10:15:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74506","title":"Red Hat Security Advisory: Satellite 6.16.14 Async Update","status":"published","published":"2026-10-02T10:25:58Z","modified":"2026-10-20T10:15:37Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-87817","description":"GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","status":"published","published":"2026-09-09T12:17:00Z","modified":"2026-09-16T14:03:37.669471275Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"CLSA-2026-1790833527","title":"TuxCare security update for gitpython (3 CVEs)","description":"TuxCare rebuilt gitpython to address 3 CVEs. Fixed in 3.1.31.post14+tuxcare.","status":"published","published":"2026-10-01T05:45:27Z","modified":"2026-10-15T09:48:02.358431482Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"openSUSE-SU-2026:21874-1","title":"Security update for python-GitPython","description":"This update for python-GitPython fixes the following issues:\n\n- CVE-2026-67322: environment-variable exfiltration in `Repo.clone_from()` URL via os.path.expandvars() (bsc#1273357).\n- CVE-2026-67323: unguarded Git options passed as keyword arguments in `Repo.archive()` and `git.ls_remote()` allow\n  for command injection (bsc#1273358).\n- CVE-2026-67325: incomplete command injection blocklist fails to account for git's long-option prefix abbreviation\n  feature and allows for bypass (bsc#1273359).\n- CVE-2026-67326: failure to validate newline characters in the section parameter of `config_writer()` can lead to\n  RCE via `core.hooksPath` (bsc#1273364).\n- CVE-2026-69097: failure to properly escape section names in Git `config` files allows for injection of arbitrary\n  configuration directives through malicious submodule names and can lead to RCE (bsc#1273414).\n- CVE-2026-73619: incomplete denylist in the `unsafe_git_archive_options` guard that omits `--add-file` and `--add-\n  virtual-file` options can lead to arbitrary file reads (bsc#1275755).\n- CVE-2026-73620: failure to guard Git option forwarding in `IndexFile.checkout()` and `TagReference.create()` can lead\n  to arbitrary file reads and writes (bsc#1275756).\n- CVE-2026-73621: argument injection in the `Commit.count()` method allows for destruction/blanking of arbitrary files\n  (bsc#1275757).\n- CVE-2026-73622: failure to disable environment variable expansion in `Remote.create()` and `Submodule.add()` URL\n  handling allows for secret exfiltration via URLs containing variable references (bsc#1275751).\n- CVE-2026-73623: incomplete denylist in `unsafe_git_clone_options` that omits `--template` allows for arbitrary command\n  execution (bsc#1275752).\n- CVE-2026-73624: `Diffable.diff` method fails to validate git options passed through `kwargs`, which can lead to\n  arbitrary file writes (bsc#1275753).\n- CVE-2026-73625: `check_unsafe_options` guard bypass via smuggling of git options inside single-character `kwarg`\n  values can lead to arbitrary code execution (bsc#1275754).\n- CVE-2026-76217: failure to validate options passed to `git rm` and `git checkout` commands in `IndexFile.remove()`\n  and `Head.checkout()` can lead to arbitrary file reads (bsc#1275745).\n- CVE-2026-76218: unguarded git option forwarding in `Repo.init` allows for arbitrary command execution (bsc#1275746).\n- CVE-2026-76219: unguarded `git read-tree` option forwarding in `IndexFile.from_tree/reset/merge_tree` can lead to\n  arbitrary file overwrites (bsc#1275747).\n- CVE-2026-76220: `check_unsafe_options` guard can be bypassed by combining a single-character `kwarg` with\n  `split_single_char_options=False`, which can lead to arbitrary OS command injection (bsc#1275748).\n- CVE-2026-76221: `config-name` injection in the `option-name` validator can lead to remote code execution\n  (bsc#1275749).\n- CVE-2026-76222: failure to validate submodule names from `.gitmodules` files allows creation of Git repositories at\n  arbitrary filesystem paths outside the intended clone directory (bsc#1275750).\n- CVE-2026-78675: failure to disable `merge_includes` when parsing `.gitmodules` can lead to discloseure of local file\n  contents when arbitrary file paths are included via `[include]` directives (bsc#1276434).\n- CVE-2026-78676: failure to safely re-serialize multi-line `git-config` values during write operations can corrupt\n  dormant quoted values into live injected directives (bsc#1276433).\n- CVE-2026-78677: omission of `--separate-git-dir` from `unsafe_git_clone_options` allows for creation of arbitrary git\n  directories outside the intended clone destination (bsc#1276432).\n- CVE-2026-78678: incomplete denylist in the `unsafe_git_revision_options` guard that omits `--contents` and `-S`\n  options allows for reading of arbitrary files when these options to are passed to `Repo.blame()` (bsc#1276431).\n- CVE-2026-78679: positional reference parameter can bypass an unsafe option guard and allows for arbitrary file read\n  via `TagReference.create()` (bsc#1276430).\n- CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the git\n  directory using tracked files and execute arbitrary code by placing pre-commit hooks in the tracked hooks directory\n  (bsc#1279905).\n- CVE-2026-87818: failure to restrict the `--no-index` option in the high-level diff API allows attackers to read\n  arbitrary filesystem paths as repository operands and create content-dependent Boolean oracles (bsc#1279906).\n- CVE-2026-87819: quadratic backtracking in the `Actor.name_email_regex` regular expression allows attackers to cause\n  CPU exhaustion and a DoS via a commit with a malformed author field (bsc#1279907).\n- GitPython unsafe clone option gate bypass through joined short options (bsc#1273498).\n","status":"published","published":"2026-09-18T06:05:46Z","modified":"2026-09-25T18:23:10.581109055Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:4191-1","title":"Security update for python-GitPython","description":"This update for python-GitPython fixes the following issues:\n\n- CVE-2026-87817: failure to properly validade the git directory location allows attackers to\n  impersonate the git directory using tracked files and execute arbitrary code by placing pre-commit hooks in the\n  tracked hooks directory (bsc#1279905).\n- CVE-2026-87818: failure to restrict the `--no-index` option in the high-level diff API allows\n  attackers to read arbitrary filesystem paths as repository operands and create content-dependent Boolean oracles\n  (bsc#1279906).\n- CVE-2026-87819: quadratic backtracking in the `Actor.name_email_regex` regular expression allows\n  attackers to cause CPU exhaustion and a DoS via a commit with a malformed author field (bsc#1279907).\n","status":"published","published":"2026-09-15T12:36:08Z","modified":"2026-09-16T10:00:05.693246336Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}