gitpython-developers vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-114145 GitPython is a python library used to interact with Git repositories.High 7.5 · Oct 21, 2026
• CVE-2026-110859 GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a brancHigh 8.7 · Oct 14, 2026
• CVE-2026-110858 GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, noCritical 9.2 · Oct 14, 2026
• CVE-2026-110857 GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unHigh 7.7 · Oct 14, 2026
• CVE-2026-110856 GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, commHigh 8.7 · Oct 14, 2026
• CVE-2026-110855 GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir High 7.1 · Oct 14, 2026
• CVE-2026-100689 GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules.High 8.7 · Sep 26, 2026
• CVE-2026-87819 GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fieldHigh 8.7 · Sep 9, 2026
• CVE-2026-87818 GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operandHigh 7.1 · Sep 9, 2026
• CVE-2026-87817 GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdHigh 8.7 · Sep 9, 2026
• CVE-2026-78679 GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe optionHigh 7.1 · Aug 24, 2026
• CVE-2026-78678 GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackerHigh 7.1 · Aug 24, 2026
• CVE-2026-78677 GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clonHigh 8.7 · Aug 24, 2026
• CVE-2026-78676 GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directCritical 9.3 · Aug 24, 2026
• CVE-2026-78675 GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file High 8.6 · Aug 24, 2026
• CVE-2026-76222 GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths ouHigh 8.4 · Aug 19, 2026
• CVE-2026-76221 GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directivHigh 8.7 · Aug 19, 2026
• CVE-2026-76220 GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg High 8.7 · Aug 19, 2026
• CVE-2026-76219 GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods thaHigh 7.2 · Aug 19, 2026
• CVE-2026-76218 GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation.High 7.7 · Aug 19, 2026
• CVE-2026-76217 GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout().High 7.1 · Aug 19, 2026
• CVE-2026-73625 GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options iHigh 8.7 · Aug 13, 2026
• CVE-2026-73624 GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed throughHigh 7.2 · Aug 13, 2026
• CVE-2026-73623 GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execuHigh 7.7 · Aug 13, 2026
• CVE-2026-73622 GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate seHigh 8.7 · Aug 13, 2026