redhat/python3.11-gitpython vulnerabilities

Latest redhat/python3.11-gitpython CVEs

Newest publication first · page 2 of 2

1. CVE-2026-42284 GitPython: Unsafe option check validates multi_options before shlex.split transforms it

   Published 2026-05-07

   Critical·CVSS 9.8 EPSS 0.57%

   GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options)). A string like "--branch main --config core.hooksPath=/x" passes validation (st...

2. CVE-2026-42215 GitPython: Command injection via Git options bypass

   Published 2026-05-07

   High·CVSS 8.8 EPSS 0.75%

   GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass tha...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.