Gitpython-developers Gitpython vulnerabilities

• gitpython-developers gitpython GitPython validates a submodule's ".git" path only after cloning into it (RCE) CVE-2026-114145 Fix available 7.5 HighOctober 21, 2026
• gitpython-developers gitpython GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move() CVE-2026-110860 Fix available 6.9 MediumOctober 14, 2026
• gitpython-developers gitpython GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name CVE-2026-110859 Fix available 8.7 HighOctober 14, 2026
• gitpython-developers gitpython GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec CVE-2026-110858 Fix available 9.2 CriticalOctober 14, 2026
• gitpython-developers gitpython GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs CVE-2026-110857 Fix available 7.7 HighOctober 14, 2026
• gitpython-developers gitpython GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date CVE-2026-110856 Fix available 8.7 HighOctober 14, 2026
• gitpython-developers gitpython GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name CVE-2026-110855 Fix available 7.1 HighOctober 14, 2026
• gitpython-developers gitpython GitPython before 3.1.62 Path Traversal via gitmodules path CVE-2026-100689 Fix available 8.7 HighSeptember 26, 2026
• gitpython-developers gitpython GitPython before 3.1.60 Denial of Service via ReDoS CVE-2026-87819 Fix available 8.7 HighSeptember 9, 2026
• gitpython-developers gitpython GitPython 3.1.59 Local File Content Oracle via --no-index CVE-2026-87818 Fix available 7.1 HighSeptember 9, 2026
• gitpython-developers gitpython GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation CVE-2026-87817 Fix available 8.7 HighSeptember 9, 2026
• gitpython-developers gitpython GitPython before 3.1.59 Arbitrary File Read via TagReference.create CVE-2026-78679 Fix available 7.1 HighAugust 25, 2026
• gitpython-developers gitpython GitPython before 3.1.59 Arbitrary File Read via Repo.blame() CVE-2026-78678 Fix available 7.1 HighAugust 25, 2026
• gitpython-developers gitpython GitPython before 3.1.59 Path Traversal via separate-git-dir CVE-2026-78677 Fix available 8.7 HighAugust 25, 2026
• gitpython-developers gitpython GitPython before 3.1.59 Remote Code Execution via Config Injection CVE-2026-78676 Fix available 9.3 CriticalAugust 25, 2026
• gitpython-developers gitpython GitPython before 3.1.59 Local File Content Disclosure via .gitmodules CVE-2026-78675 Fix available 8.6 HighAugust 25, 2026
• gitpython-developers gitpython GitPython before 3.1.58 Command Execution via split_single_char_options CVE-2026-76220 Fix available 8.7 HighAugust 7, 2026
• gitpython-developers gitpython GitPython before 3.1.58 Config Injection via option-name CVE-2026-76221 Fix available 8.7 HighAugust 7, 2026
• gitpython-developers gitpython GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name CVE-2026-76222 Fix available 8.4 HighAugust 7, 2026
• gitpython-developers gitpython GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file CVE-2026-76217 Fix available 7.1 HighAugust 7, 2026
• gitpython-developers gitpython GitPython before 3.1.58 Remote Code Execution via Repo.init CVE-2026-76218 Fix available 7.7 HighAugust 7, 2026
• gitpython-developers gitpython GitPython before 3.1.58 Arbitrary File Overwrite via read-tree CVE-2026-76219 Fix available 7.2 HighAugust 7, 2026
• gitpython-developers gitpython GitPython before 3.1.56 Arbitrary File Truncation via Commit.count CVE-2026-73621 Fix available 5.3 MediumAugust 3, 2026
• gitpython-developers gitpython GitPython before 3.1.57 Arbitrary File Read via Repo.archive() CVE-2026-73619 Fix available 7.1 HighAugust 3, 2026
• gitpython-developers gitpython GitPython before 3.1.57 Arbitrary File Overwrite and Read CVE-2026-73620 Fix available 7.2 HighAugust 3, 2026
• gitpython-developers gitpython GitPython before 3.1.50 Newline Injection via config_writer section CVE-2026-67326 Fix available 7.3 HighJuly 28, 2026
• gitpython-developers gitpython GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() CVE-2026-73622 Fix available 8.7 HighJuly 24, 2026
• gitpython-developers gitpython GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling CVE-2026-73625 Fix available 8.7 HighJuly 24, 2026
• gitpython-developers gitpython GitPython before 3.1.54 Remote Code Execution via --template CVE-2026-73623 Fix available 7.7 HighJuly 24, 2026
• gitpython-developers gitpython GitPython before 3.1.54 Arbitrary File Overwrite via diff CVE-2026-73624 Fix available 7.2 HighJuly 24, 2026
• gitpython-developers gitpython GitPython before 3.1.53 Config Injection via Submodule Names CVE-2026-69097 Fix available 7.3 HighJuly 24, 2026
• gitpython-developers gitpython GitPython before 3.1.52 Environment Variable Exfiltration via clone_from CVE-2026-67322 Fix available 8.7 HighJuly 21, 2026
• gitpython-developers gitpython GitPython before 3.1.51 Command Injection via unguarded Git options CVE-2026-67323 Fix available 8.6 HighJuly 21, 2026
• gitpython-developers gitpython GitPython before 3.1.51 Command Injection via option prefix abbreviation CVE-2026-67325 Fix available 8.7 HighJuly 21, 2026
• gitpython-developers gitpython GitPython 3.1.50 Authentication Bypass via Joined Short Options CVE-2026-67324 Fix available 9.3 CriticalJuly 21, 2026
• gitpython-developers gitpython GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath CVE-2026-44244 Fix available 7.8 HighMay 6, 2026
• gitpython-developers gitpython GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository CVE-2026-44243 Fix available 7.8 HighMay 6, 2026
• gitpython-developers gitpython GitPython: Command injection via Git options bypass CVE-2026-42215 Fix available 8.8 HighApril 25, 2026
• gitpython-developers gitpython GitPython: Unsafe option check validates multi_options before shlex.split transforms it CVE-2026-42284 Fix available 8.1 HighApril 25, 2026
• gitpython-developers gitpython Untrusted search path under some conditions on Windows allows arbitrary code execution CVE-2024-22190 Fix available 7.8 HighJanuary 10, 2024
• gitpython-developers gitpython GitPython blind local file inclusion CVE-2023-41040 Fix available 4.0 MediumAugust 30, 2023
• gitpython-developers gitpython Untrusted search path on Windows systems leading to arbitrary code execution CVE-2023-40590 Fix available 7.8 HighAugust 28, 2023
• gitpython-developers gitpython, debian linux, fedoraproject fedora +2 more Remote Code Execution (RCE) CVE-2022-24439 Public exploitFix available 8.1 HighDecember 6, 2022