Skip to content

Product

redhat/python-gitpython vulnerabilities

36 published CVES affecting redhat/python-gitpython, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
36
Critical
4
High
30
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest redhat/python-gitpython CVEs

Newest publication first · page 1 of 2

  8. CVE-2026-96659 Foreman: excessive permissions for viewer role on preview

    Published
    CriticalCVSS 9.1 EPSS 0.35%

    A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as...

  10. CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path

    Published
    HighCVSS 8.7 EPSS 0.40%

    GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the name field, and GitPython's own containment guard Submodule._to_re...

  11. CVE-2026-87819 GitPython before 3.1.60 Denial of Service via ReDoS

    Published
    HighCVSS 8.7 EPSS 0.52%

    GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause q...

  12. CVE-2026-87818 GitPython 3.1.59 Local File Content Oracle via --no-index

    Published
    HighCVSS 7.1 EPSS 0.41%

    GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeat...

  15. CVE-2026-78678 GitPython before 3.1.59 Arbitrary File Read via Repo.blame()

    Published
    HighCVSS 7.1 EPSS 0.41%

    GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents...

  16. CVE-2026-78677 GitPython before 3.1.59 Path Traversal via separate-git-dir

    Published
    HighCVSS 8.7 EPSS 0.65%

    GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect reposito...

  17. CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection

    Published
    CriticalCVSS 9.3 EPSS 0.56%

    GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after...

  21. CVE-2026-76221 GitPython before 3.1.58 Config Injection via option-name

    Published
    HighCVSS 8.7 EPSS 0.49%

    GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option name...

  22. CVE-2026-76219 GitPython before 3.1.58 Arbitrary File Overwrite via read-tree

    Published
    HighCVSS 7.2 EPSS 0.54%

    GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers...

  24. CVE-2026-76218 GitPython before 3.1.58 Remote Code Execution via Repo.init

    Published
    HighCVSS 7.7 EPSS 0.72%

    GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.