GI
Vendor
gitpython-developers
39
CVEs
0
On KEV
7
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114145 New | GI GitPython gitpython-developers | 7.5 | Oct 21 | GitPython validates a submodule's ".git" path only after cloning into it (RCE) |
| CVE-2026-110860 | GI GitPython gitpython-developers | 6.1 | Oct 14 | GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move() |
| CVE-2026-110859 | GI GitPython gitpython-developers | 7.5 | Oct 14 | GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name |
| CVE-2026-110858 | GI GitPython gitpython-developers | 8.1 | Oct 14 | GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec |
| CVE-2026-110857 | GI GitPython gitpython-developers | 7.5 | Oct 14 | GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs |
| CVE-2026-110856 | GI GitPython gitpython-developers | 7.5 | Oct 14 | GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date |
| CVE-2026-110855 | GI GitPython gitpython-developers | 6.5 | Oct 14 | GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name |
| CVE-2026-100689 | GI GitPython gitpython-developers | 5.9 | Sep 26 | GitPython before 3.1.62 Path Traversal via gitmodules path |
| CVE-2026-87819 | GI GitPython gitpython-developers | 7.5 | Sep 9 | GitPython before 3.1.60 Denial of Service via ReDoS |
| CVE-2026-87818 | GI GitPython gitpython-developers | 6.5 | Sep 9 | GitPython 3.1.59 Local File Content Oracle via --no-index |
| CVE-2026-87817 | GI GitPython gitpython-developers | 8.8 | Sep 9 | GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation |
| CVE-2026-78679 | GI GitPython gitpython-developers | 6.5 | Aug 25 | GitPython before 3.1.59 Arbitrary File Read via TagReference.create |
| CVE-2026-78678 | GI GitPython gitpython-developers | 6.5 | Aug 25 | GitPython before 3.1.59 Arbitrary File Read via Repo.blame() |
| CVE-2026-78677 | GI GitPython gitpython-developers | 7.5 | Aug 25 | GitPython before 3.1.59 Path Traversal via separate-git-dir |
| CVE-2026-78676 | GI GitPython gitpython-developers | 9.8 | Aug 25 | GitPython before 3.1.59 Remote Code Execution via Config Injection |
| CVE-2026-78675 | GI GitPython gitpython-developers | 7.8 | Aug 25 | GitPython before 3.1.59 Local File Content Disclosure via .gitmodules |
| CVE-2026-76222 | GI GitPython gitpython-developers | 8.2 | Aug 19 | GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name |
| CVE-2026-76221 | GI GitPython gitpython-developers | 8.8 | Aug 19 | GitPython before 3.1.58 Config Injection via option-name |
| CVE-2026-76220 | GI GitPython gitpython-developers | 8.8 | Aug 19 | GitPython before 3.1.58 Command Execution via split_single_char_options |
| CVE-2026-76219 | GI GitPython gitpython-developers | 8.1 | Aug 19 | GitPython before 3.1.58 Arbitrary File Overwrite via read-tree |
| CVE-2026-76218 | GI GitPython gitpython-developers | 8.8 | Aug 19 | GitPython before 3.1.58 Remote Code Execution via Repo.init |
| CVE-2026-76217 | GI GitPython gitpython-developers | 6.5 | Aug 19 | GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file |
| CVE-2026-73625 | GI GitPython gitpython-developers | 8.8 | Aug 13 | GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling |
| CVE-2026-73624 | GI GitPython gitpython-developers | 8.1 | Aug 13 | GitPython before 3.1.54 Arbitrary File Overwrite via diff |
| CVE-2026-73623 | GI GitPython gitpython-developers | 8.8 | Aug 13 | GitPython before 3.1.54 Remote Code Execution via --template |
| CVE-2026-73622 | GI GitPython gitpython-developers | 7.5 | Aug 13 | GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() |
| CVE-2026-73621 | GI GitPython gitpython-developers | 5.4 | Aug 13 | GitPython before 3.1.56 Arbitrary File Truncation via Commit.count |
| CVE-2026-73620 | GI GitPython gitpython-developers | 8.1 | Aug 13 | GitPython before 3.1.57 Arbitrary File Overwrite and Read |
| CVE-2026-73619 | GI GitPython gitpython-developers | 6.5 | Aug 13 | GitPython before 3.1.57 Arbitrary File Read via Repo.archive() |
| CVE-2026-69097 | GI GitPython gitpython-developers | 7.3 | Aug 3 | GitPython before 3.1.53 Config Injection via Submodule Names |
| CVE-2026-67326 | GI GitPython gitpython-developers | 7.8 | Aug 1 | GitPython before 3.1.50 Newline Injection via config_writer section |
| CVE-2026-67324 | GI GitPython gitpython-developers | 9.8 | Aug 1 | GitPython 3.1.50 Authentication Bypass via Joined Short Options |
| CVE-2026-67323 | GI GitPython gitpython-developers | 8.4 | Aug 1 | GitPython before 3.1.51 Command Injection via unguarded Git options |
| CVE-2026-67322 | GI GitPython gitpython-developers | 7.5 | Aug 1 | GitPython before 3.1.52 Environment Variable Exfiltration via clone_from |
| CVE-2026-67325 | GI GitPython gitpython-developers | 8.8 | Aug 1 | GitPython before 3.1.51 Command Injection via option prefix abbreviation |
| CVE-2026-44243 | GI GitPython gitpython-developers | 7.1 | May 7 | GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository |
| CVE-2026-44244 | GI GitPython gitpython-developers | 7.8 | May 7 | GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath |
| CVE-2026-42284 | GI GitPython gitpython-developers | 9.8 | May 7 | GitPython: Unsafe option check validates multi_options before shlex.split transforms it |
| CVE-2026-42215 | GI GitPython gitpython-developers | 8.8 | May 7 | GitPython: Command injection via Git options bypass |