GI
Product
GitPython
39
CVEs
0
On KEV
9.8
Max CVSS
7
New 30D
Severity mix
Critical 3High 27Medium 9Low 0
Watch
Add GitPython to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-87817 | 8.8 | Sep 9 | GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation Affected: before 3.1.60 |
| CVE-2026-76221 | 8.8 | Aug 19 | GitPython before 3.1.58 Config Injection via option-name Affected: before 3.1.58 |
| CVE-2026-76220 | 8.8 | Aug 19 | GitPython before 3.1.58 Command Execution via split_single_char_options Affected: before 3.1.58 |
| CVE-2026-76218 | 8.8 | Aug 19 | GitPython before 3.1.58 Remote Code Execution via Repo.init Affected: before 3.1.58 |
| CVE-2026-73625 | 8.8 | Aug 13 | GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling Affected: before 3.1.54 |
| CVE-2026-73623 | 8.8 | Aug 13 | GitPython before 3.1.54 Remote Code Execution via --template Affected: before 3.1.54 |
| CVE-2026-67325 | 8.8 | Aug 1 | GitPython before 3.1.51 Command Injection via option prefix abbreviation Affected: before 3.1.51 |
| CVE-2026-42215 | 8.8 | May 7 | GitPython: Command injection via Git options bypass Affected: >= 3.1.30, < 3.1.47 |
| CVE-2026-67323 | 8.4 | Aug 1 | GitPython before 3.1.51 Command Injection via unguarded Git options Affected: before 3.1.51 |
| CVE-2026-76222 | 8.2 | Aug 19 | GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name Affected: before 3.1.58 |
| CVE-2026-110858 | 8.1 | Oct 14 | GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec Affected: 3.1.30 before 3.2.0 |
| CVE-2026-76219 | 8.1 | Aug 19 | GitPython before 3.1.58 Arbitrary File Overwrite via read-tree Affected: before 3.1.58 |
| CVE-2026-73624 | 8.1 | Aug 13 | GitPython before 3.1.54 Arbitrary File Overwrite via diff Affected: before 3.1.54 |
| CVE-2026-73620 | 8.1 | Aug 13 | GitPython before 3.1.57 Arbitrary File Overwrite and Read Affected: before 3.1.57 |
| CVE-2026-78675 | 7.8 | Aug 25 | GitPython before 3.1.59 Local File Content Disclosure via .gitmodules Affected: before 3.1.59 |
| CVE-2026-67326 | 7.8 | Aug 1 | GitPython before 3.1.50 Newline Injection via config_writer section Affected: before 3.1.50 |
| CVE-2026-44244 | 7.8 | May 7 | GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath Affected: < 3.1.49 |
| CVE-2026-114145 New | 7.5 | Oct 21 | GitPython validates a submodule's ".git" path only after cloning into it (RCE) Affected: < 3.2.1 |
| CVE-2026-110859 | 7.5 | Oct 14 | GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name Affected: before 3.2.0 |
| CVE-2026-110857 | 7.5 | Oct 14 | GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs Affected: before 3.2.0 |
| CVE-2026-110856 | 7.5 | Oct 14 | GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date Affected: before 3.2.0 |
| CVE-2026-87819 | 7.5 | Sep 9 | GitPython before 3.1.60 Denial of Service via ReDoS Affected: before 3.1.60 |
| CVE-2026-78677 | 7.5 | Aug 25 | GitPython before 3.1.59 Path Traversal via separate-git-dir Affected: before 3.1.59 |
| CVE-2026-73622 | 7.5 | Aug 13 | GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() Affected: before 3.1.55 |
| CVE-2026-67322 | 7.5 | Aug 1 | GitPython before 3.1.52 Environment Variable Exfiltration via clone_from Affected: before 3.1.52 |
| CVE-2026-69097 | 7.3 | Aug 3 | GitPython before 3.1.53 Config Injection via Submodule Names Affected: before 3.1.53 |
| CVE-2026-44243 | 7.1 | May 7 | GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository Affected: < 3.1.48 |
Showing 27