Skip to content

Product

pypi gitpython vulnerabilities

44 published CVES affecting pypi gitpython, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
44
Critical
5
High
36
Medium
3
Low
0
Unscored
0
CISA KEV
0

Latest pypi gitpython CVEs

Newest publication first · page 1 of 2

  8. CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path

    Published
    HighCVSS 8.7 EPSS 0.40%

    GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the name field, and GitPython's own containment guard Submodule._to_re...

  9. CVE-2026-87819 GitPython before 3.1.60 Denial of Service via ReDoS

    Published
    HighCVSS 8.7

    GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause q...

  10. CVE-2026-87818 GitPython 3.1.59 Local File Content Oracle via --no-index

    Published
    HighCVSS 7.1

    GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeat...

  13. CVE-2026-78678 GitPython before 3.1.59 Arbitrary File Read via Repo.blame()

    Published
    HighCVSS 7.1 EPSS 0.41%

    GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents...

  14. CVE-2026-78677 GitPython before 3.1.59 Path Traversal via separate-git-dir

    Published
    HighCVSS 8.7

    GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect reposito...

  15. CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection

    Published
    CriticalCVSS 9.3 EPSS 0.56%

    GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after...

  19. CVE-2026-76221 GitPython before 3.1.58 Config Injection via option-name

    Published
    HighCVSS 8.7

    GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option name...

  20. CVE-2026-76219 GitPython before 3.1.58 Arbitrary File Overwrite via read-tree

    Published
    HighCVSS 7.2 EPSS 0.54%

    GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers...

  22. CVE-2026-76218 GitPython before 3.1.58 Remote Code Execution via Repo.init

    Published
    HighCVSS 7.7

    GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are...

  24. CVE-2026-73624 GitPython before 3.1.54 Arbitrary File Overwrite via diff

    Published
    HighCVSS 7.2

    GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to at...

  25. CVE-2026-73623 GitPython before 3.1.54 Remote Code Execution via --template

    Published
    HighCVSS 7.7

    GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.