HIGH7.1PyPI
GHSA-7545-fcxq-7j24· CVE-2026-44243, PYSEC-2026-2162GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
Modified: 9/10/2026
package
PyPI/gitpython
pkg:pypi/gitpython
HIGH8.8PyPI
GHSA-239g-whfq-7xj9· CVE-2026-87817, PYSEC-2026-3982GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
Modified: 9/30/2026
CRITICAL9.8PyPI
GHSA-284h-m62q-gf8w· CVE-2026-78676, PYSEC-2026-3786GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
Modified: 9/8/2026
HIGH8.8PyPI
GHSA-2f96-g7mh-g2hx· CVE-2026-67325, PYSEC-2026-3836GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
Modified: 9/23/2026
HIGH7.8PyPI
GHSA-2mqj-m65w-jghx· CVE-2024-22190, PYSEC-2024-4Untrusted search path under some conditions on Windows allows arbitrary code execution
Modified: 9/10/2026
HIGH8.1PyPI
GHSA-3f7w-8rr8-f37f· CVE-2026-73620, PYSEC-2026-3949GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
Modified: 9/10/2026
HIGH7.0PyPI
GHSA-3rp5-jjmw-4wv2· CVE-2026-69097, PYSEC-2026-3981GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
Modified: 9/17/2026
MEDIUM6.5PyPI
GHSA-3wxw-xv34-2frg· CVE-2026-78679, PYSEC-2026-3837GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)
Modified: 9/23/2026
HIGH8.1PyPI
GHSA-4gmw-gg2m-w46p· CVE-2026-76219, PYSEC-2026-3838GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
Modified: 9/10/2026
MEDIUM6.5PyPI
GHSA-539m-9xh6-q6rr· CVE-2026-73619, PYSEC-2026-3948GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
Modified: 9/10/2026
MEDIUM6.1PyPI
GHSA-59cr-6r3x-644w· CVE-2026-100689GitPython submodule update path traversal can write outside the repository
Modified: 10/1/2026
MEDIUM6.5PyPI
GHSA-5xxx-qhh7-9287· CVE-2026-78678, PYSEC-2026-3788GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()
Modified: 9/8/2026
HIGH7.5PyPI
GHSA-6p8h-3wgx-97gf· CVE-2026-73623, PYSEC-2026-3952GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
Modified: 9/10/2026
HIGH8.4PyPI
GHSA-7833-fr7j-v32q· CVE-2026-78675, PYSEC-2026-3785GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)
Modified: 9/23/2026
HIGH7.5PyPI
GHSA-8mcc-hrx5-hvxc· CVE-2026-78677, PYSEC-2026-3787GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
Modified: 9/8/2026
HIGH7.5PyPI
GHSA-94p4-4cq8-9g67· CVE-2026-73622, PYSEC-2026-3951GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
Modified: 9/24/2026
HIGH8.4PyPI
GHSA-956x-8gvw-wg5v· CVE-2026-67323, PYSEC-2026-3839GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-9rj7-rf2p-w77r· CVE-2026-76218, PYSEC-2026-3840GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
Modified: 9/10/2026
MEDIUM4.0PyPI
GHSA-cwvm-v4w8-q58c· CVE-2023-41040, PYSEC-2023-165GitPython blind local file inclusion
Modified: 11/4/2025
HIGH8.1PyPI
GHSA-fjr4-x663-mwxc· CVE-2026-73624, PYSEC-2026-3995GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
Modified: 9/29/2026
HIGH7.5PyPI
GHSA-g5vv-9gxw-82hx· CVE-2026-87819, PYSEC-2026-3984GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
Modified: 9/30/2026
HIGH8.1PyPI
GHSA-hcpj-qp55-gfph· CVE-2022-24439, PYSEC-2022-42992GitPython vulnerable to Remote Code Execution due to improper user input validation
Modified: 11/4/2025
MEDIUM6.5PyPI
GHSA-hh9p-6wh2-4mfc· CVE-2026-76217, PYSEC-2026-3841GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
Modified: 9/10/2026
HIGH8.2PyPI
GHSA-hmq2-w58f-27jc· CVE-2026-76222, PYSEC-2026-3784GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
Modified: 9/8/2026
HIGH8.8PyPI
GHSA-jm78-9fvv-mhgr· CVE-2026-76221, PYSEC-2026-3783GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
Modified: 9/10/2026
HIGH7.0PyPI
GHSA-mv93-w799-cj2w· CVE-2026-67326, PYSEC-2026-3980GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
Modified: 9/17/2026
MEDIUM5.4PyPI
GHSA-p538-c434-8v24· CVE-2026-73621, PYSEC-2026-3950GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count
Modified: 9/10/2026
CRITICAL9.8PyPI
GHSA-pr76-5cm5-w9cj· CVE-2023-40267, PYSEC-2023-137GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
Modified: 11/4/2025
HIGH8.8PyPI
GHSA-r9mr-m37c-5fr3· CVE-2026-73625, PYSEC-2026-3953GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
Modified: 9/10/2026
HIGH8.8PyPI
GHSA-rpm5-65cw-6hj4· CVE-2026-42215, PYSEC-2026-2160GitPython has Command Injection via Git options bypass
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-rwj8-pgh3-r573· CVE-2026-67322, PYSEC-2026-3842GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
Modified: 9/24/2026
HIGH8.7PyPI
GHSA-v396-v7q4-x2qj· CVE-2026-67324, PYSEC-2026-3947GitPython unsafe clone option gate bypass through joined short options
Modified: 9/10/2026
HIGH7.8PyPI
GHSA-v87r-6q3f-2j67· CVE-2026-44244, PYSEC-2026-2163GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
Modified: 9/10/2026
HIGH7.8PyPI
GHSA-wfm5-v35h-vwf4· CVE-2023-40590, PYSEC-2023-161GitPython untrusted search path on Windows systems leading to arbitrary code execution
Modified: 9/10/2026
MEDIUM6.5PyPI
GHSA-whh4-5q6c-9v3x· CVE-2026-87818GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle
Modified: 10/1/2026
HIGH8.8PyPI
GHSA-wvpp-8hx9-p66j· CVE-2026-76220, PYSEC-2026-3843GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
Modified: 9/10/2026
HIGH8.1PyPI
GHSA-x2qx-6953-8485· CVE-2026-42284, PYSEC-2026-2161GitPython: Unsafe option check validates multi_options before shlex.split transformation
Modified: 9/10/2026
CRITICAL9.8PyPI
PYSEC-2022-42992· CVE-2022-24439, GHSA-hcpj-qp55-gfphModified: 6/10/2026
CRITICAL9.8PyPI
PYSEC-2023-137· CVE-2023-40267, GHSA-pr76-5cm5-w9cjModified: 11/8/2023
HIGH7.8PyPI
PYSEC-2023-161· CVE-2023-40590, GHSA-wfm5-v35h-vwf4Modified: 11/8/2023
MEDIUM6.5PyPI
PYSEC-2023-165· CVE-2023-41040, GHSA-cwvm-v4w8-q58cModified: 11/8/2023
HIGH7.8PyPI
PYSEC-2024-4· CVE-2024-22190, GHSA-2mqj-m65w-jghxModified: 1/18/2024
HIGH8.8PyPI
PYSEC-2026-2160· CVE-2026-42215, GHSA-rpm5-65cw-6hj4Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-2161· CVE-2026-42284, GHSA-x2qx-6953-8485Modified: 7/13/2026
HIGH7.1PyPI
PYSEC-2026-2162· CVE-2026-44243, GHSA-7545-fcxq-7j24Modified: 7/13/2026
HIGH7.8PyPI
PYSEC-2026-2163· CVE-2026-44244, GHSA-v87r-6q3f-2j67Modified: 7/13/2026
HIGH8.7PyPI
PYSEC-2026-3783· CVE-2026-76221, GHSA-jm78-9fvv-mhgrModified: 9/3/2026
HIGH8.4PyPI
PYSEC-2026-3784· CVE-2026-76222, GHSA-hmq2-w58f-27jcModified: 9/3/2026
HIGH7.8PyPI
PYSEC-2026-3785· CVE-2026-78675, GHSA-7833-fr7j-v32qModified: 9/3/2026
CRITICAL9.3PyPI
PYSEC-2026-3786· CVE-2026-78676, GHSA-284h-m62q-gf8wModified: 9/3/2026
HIGH8.7PyPI
PYSEC-2026-3787· CVE-2026-78677, GHSA-8mcc-hrx5-hvxcModified: 9/3/2026
HIGH7.1PyPI
PYSEC-2026-3788· CVE-2026-78678, GHSA-5xxx-qhh7-9287Modified: 9/3/2026
HIGH8.8PyPI
PYSEC-2026-3836· CVE-2026-67325, GHSA-2f96-g7mh-g2hxGitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
Modified: 9/10/2026
MEDIUM6.5PyPI
PYSEC-2026-3837· CVE-2026-78679, GHSA-3wxw-xv34-2frgGitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)
Modified: 9/10/2026
HIGH8.1PyPI
PYSEC-2026-3838· CVE-2026-76219, GHSA-4gmw-gg2m-w46pGitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
Modified: 9/10/2026
HIGH8.4PyPI
PYSEC-2026-3839· CVE-2026-67323, GHSA-956x-8gvw-wg5vGitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
Modified: 9/10/2026
HIGH7.5PyPI
PYSEC-2026-3840· CVE-2026-76218, GHSA-9rj7-rf2p-w77rGitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
Modified: 9/10/2026
MEDIUM6.5PyPI
PYSEC-2026-3841· CVE-2026-76217, GHSA-hh9p-6wh2-4mfcGitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
Modified: 9/10/2026
HIGH7.5PyPI
PYSEC-2026-3842· CVE-2026-67322, GHSA-rwj8-pgh3-r573GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
Modified: 9/10/2026
HIGH8.8PyPI
PYSEC-2026-3843· CVE-2026-76220, GHSA-wvpp-8hx9-p66jGitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
Modified: 9/10/2026
CRITICAL9.3PyPI
PYSEC-2026-3947· CVE-2026-67324, GHSA-v396-v7q4-x2qjModified: 9/11/2026
HIGH7.1PyPI
PYSEC-2026-3948· CVE-2026-73619, GHSA-539m-9xh6-q6rrModified: 9/10/2026
HIGH7.2PyPI
PYSEC-2026-3949· CVE-2026-73620, GHSA-3f7w-8rr8-f37fModified: 9/10/2026
MEDIUM5.3PyPI
PYSEC-2026-3950· CVE-2026-73621, GHSA-p538-c434-8v24Modified: 9/10/2026
HIGH8.7PyPI
PYSEC-2026-3951· CVE-2026-73622, GHSA-94p4-4cq8-9g67Modified: 9/10/2026
HIGH8.8PyPI
PYSEC-2026-3952· CVE-2026-73623, GHSA-6p8h-3wgx-97gfModified: 9/10/2026
HIGH8.7PyPI
PYSEC-2026-3953· CVE-2026-73625, GHSA-r9mr-m37c-5fr3Modified: 9/10/2026
HIGH7.8PyPI
PYSEC-2026-3980· CVE-2026-67326, GHSA-mv93-w799-cj2wModified: 9/17/2026
HIGH7.3PyPI
PYSEC-2026-3981· CVE-2026-69097, GHSA-3rp5-jjmw-4wv2Modified: 9/17/2026
HIGH8.7PyPI
PYSEC-2026-3982· CVE-2026-87817, GHSA-239g-whfq-7xj9Modified: 9/17/2026
HIGH7.5PyPI
PYSEC-2026-3984· CVE-2026-87819, GHSA-g5vv-9gxw-82hxModified: 9/17/2026
HIGH7.2PyPI
PYSEC-2026-3995· CVE-2026-73624, GHSA-fjr4-x663-mwxcModified: 9/29/2026