gitpython-developers/gitpython Security Advisories | GitStock

high2026-10-22

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

GHSA-83vg-56qc-22m7 · CVE-2026-114145

medium2026-09-30

GitPython submodule update path traversal can write outside the repository

GHSA-59cr-6r3x-644w

high2026-09-30

GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

GHSA-g5vv-9gxw-82hx · CVE-2026-87819

medium2026-09-30

GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle

GHSA-whh4-5q6c-9v3x

high2026-09-30

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

GHSA-239g-whfq-7xj9 · CVE-2026-87817

medium2026-09-08

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

GHSA-3wxw-xv34-2frg · CVE-2026-78679

high2026-09-08

GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

GHSA-8mcc-hrx5-hvxc · CVE-2026-78677

medium2026-09-08

GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()

GHSA-5xxx-qhh7-9287 · CVE-2026-78678

critical2026-09-08

GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

GHSA-284h-m62q-gf8w · CVE-2026-78676

high2026-09-08

GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

GHSA-7833-fr7j-v32q · CVE-2026-78675

high2026-08-07

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

GHSA-wvpp-8hx9-p66j · CVE-2026-76220

high2026-08-07

GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

GHSA-jm78-9fvv-mhgr

high2026-08-07

GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

GHSA-hmq2-w58f-27jc · CVE-2026-76222

medium2026-08-07

GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

GHSA-hh9p-6wh2-4mfc · CVE-2026-76217

high2026-08-07

GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

GHSA-9rj7-rf2p-w77r · CVE-2026-76218

high2026-08-07

GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

GHSA-4gmw-gg2m-w46p · CVE-2026-76219

medium2026-08-03

GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count

GHSA-p538-c434-8v24

medium2026-08-03

GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()

GHSA-539m-9xh6-q6rr

high2026-08-03

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

GHSA-3f7w-8rr8-f37f

high2026-07-24

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

GHSA-94p4-4cq8-9g67