gitpython-developers/gitpython Security Advisories | GitStock

high2026-07-24

GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

GHSA-r9mr-m37c-5fr3

high2026-07-24

GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

GHSA-6p8h-3wgx-97gf

high2026-07-24

GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

GHSA-fjr4-x663-mwxc

high2026-07-24

GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

GHSA-3rp5-jjmw-4wv2 · CVE-2026-69097

high2026-07-21

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

GHSA-rwj8-pgh3-r573 · CVE-2026-67322

high2026-07-21

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

GHSA-956x-8gvw-wg5v · CVE-2026-67323

high2026-07-21

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

GHSA-2f96-g7mh-g2hx · CVE-2026-67325

high2026-07-21

GitPython unsafe clone option gate bypass through joined short options

GHSA-v396-v7q4-x2qj

high2026-05-08

GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

GHSA-mv93-w799-cj2w

high2026-05-06

GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

GHSA-v87r-6q3f-2j67 · CVE-2026-44244

high2026-05-06

GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

GHSA-7545-fcxq-7j24 · CVE-2026-44243

high2026-04-25

GitPython has Command Injection via Git options bypass

GHSA-rpm5-65cw-6hj4 · CVE-2026-42215

high2026-04-25

GitPython: Unsafe option check validates multi_options before shlex.split transformation

GHSA-x2qx-6953-8485 · CVE-2026-42284

high2024-01-10

Untrusted search path under some conditions on Windows allows arbitrary code execution

GHSA-2mqj-m65w-jghx · CVE-2024-22190

medium2023-08-30

GitPython blind local file inclusion

GHSA-cwvm-v4w8-q58c · CVE-2023-41040

high2023-08-29

GitPython untrusted search path on Windows systems leading to arbitrary code execution

GHSA-wfm5-v35h-vwf4 · CVE-2023-40590

critical2023-08-11

GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

GHSA-pr76-5cm5-w9cj · CVE-2023-40267

critical2022-12-06

GitPython vulnerable to Remote Code Execution due to improper user input validation

GHSA-hcpj-qp55-gfph · CVE-2022-24439