gitpython-developers GitPython vulnerabilities

Latest gitpython-developers GitPython CVEs

Newest publication first

1. CVE-2026-114145 GitPython validates a submodule's ".git" path only after cloning into it (RCE)

   Published 2026-10-21

   High·CVSS 7.5 EPSS 0.42%

   GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the destination. In 3.1.x,...

2. CVE-2026-44243 GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository

   Published 2026-05-07

   High·CVSS 7.8

   GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository...

3. CVE-2026-44244 GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

   Published 2026-05-07

   High·CVSS 7.8

   GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines...

4. CVE-2026-42284 GitPython: Unsafe option check validates multi_options before shlex.split transforms it

   Published 2026-05-07

   High·CVSS 8.1

   GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options)). A string like "--branch main --config core.hooksPath=/x" passes validation (st...

5. CVE-2026-42215 GitPython: Command injection via Git options bypass

   Published 2026-05-07

   High·CVSS 8.8

   GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass tha...

6. CVE-2023-41040 GitPython blind local file inclusion

   Published 2023-08-30

   Medium·CVSS 4.0

   GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the .git directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located ou...

7. CVE-2023-40590 Untrusted search path on Windows systems leading to arbitrary code execution

   Published 2023-08-28

   High·CVSS 7.8

   GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the git command, if a user runs GitPython from a repo has a git.ex...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.