Gitpython Project Gitpython
29 CVEs affecting Gitpython Project Gitpython. Latest disclosed: 2026-08-25. Critical: 3, High: 21.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-78676 | Critical | 9.8 | 2026-08-25 | GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected direc… |
CVE-2026-67324 | Critical | 9.8 | 2026-08-01 | GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-opt… |
CVE-2023-40267 | Critical | 9.8 | 2023-08-11 | GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24… |
CVE-2026-76221 | High | 8.8 | 2026-08-19 | GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directi… |
CVE-2026-76220 | High | 8.8 | 2026-08-19 | GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg… |
CVE-2026-73625 | High | 8.8 | 2026-08-13 | GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options… |
CVE-2026-67325 | High | 8.8 | 2026-08-01 | GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers c… |
CVE-2026-42215 | High | 8.8 | 2026-05-07 | GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such… |
CVE-2026-78675 | High | 8.4 | 2026-08-25 | GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file… |
CVE-2026-67323 | High | 8.4 | 2026-08-01 | GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command inject… |
CVE-2026-76222 | High | 8.2 | 2026-08-19 | GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths o… |
CVE-2026-76219 | High | 8.1 | 2026-08-19 | GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods th… |
CVE-2026-73620 | High | 8.1 | 2026-08-13 | GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via k… |
CVE-2026-42284 | High | 8.1 | 2026-05-07 | GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then exec… |
CVE-2022-24439 | High | 8.1 | 2022-12-06 | All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a mali… |
CVE-2026-44244 | High | 7.8 | 2026-05-07 | GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configpars… |
CVE-2024-22190 | High | 7.8 | 2024-01-11 | GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted se… |
CVE-2023-40590 | High | 7.8 | 2023-08-28 | GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and aft… |
CVE-2026-78677 | High | 7.5 | 2026-08-25 | GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clo… |
CVE-2026-76218 | High | 7.5 | 2026-08-19 | GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a… |