CVE-2026-73625 | High | 8.8 | 2026-08-13 | GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options… |
CVE-2026-73624 | High | 8.1 | 2026-08-13 | GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed throug… |
CVE-2026-73623 | High | 7.5 | 2026-08-13 | GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command exec… |
CVE-2026-73622 | High | 7.5 | 2026-08-13 | GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate s… |
CVE-2026-73621 | Medium | 5.4 | 2026-08-13 | GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without t… |
CVE-2026-73620 | High | 8.1 | 2026-08-13 | GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via k… |
CVE-2026-73619 | Medium | 6.5 | 2026-08-13 | GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers… |
CVE-2026-69097 | High | 7.0 | 2026-08-03 | GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through mal… |
CVE-2026-67326 | High | 7.0 | 2026-08-01 | GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section header… |
CVE-2026-67325 | High | 8.8 | 2026-08-01 | GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers c… |
CVE-2026-67324 | Critical | 9.8 | 2026-08-01 | GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-opt… |
CVE-2026-67323 | High | 8.4 | 2026-08-01 | GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command inject… |
CVE-2026-67322 | High | 7.5 | 2026-08-01 | GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_ur… |
CVE-2026-44244 | High | 7.8 | 2026-05-07 | GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configpars… |
CVE-2026-44243 | High | 7.1 | 2026-05-07 | GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a c… |
CVE-2026-42284 | High | 8.1 | 2026-05-07 | GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then exec… |
CVE-2026-42215 | High | 8.8 | 2026-05-07 | GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such… |
CVE-2024-22190 | High | 7.8 | 2024-01-11 | GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted se… |
CVE-2023-41040 | Medium | 4.0 | 2023-08-30 | GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory… |
CVE-2023-40590 | High | 7.8 | 2023-08-28 | GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and aft… |