gitpython-developers GitPython
42 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-114145 | < 3.2.1 | GitPython validates a submodule's ".git" path only after cloning into it (RCE) | HIGH 7.5 | 0.4 % | ||
| CVE-2026-110860 | 3.1.62 – < 3.2.0 | GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move() | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-110859 | < 3.2.0 | GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name | HIGH 8.7 | 0.4 % | ||
| CVE-2026-110858 | 3.1.30 – < 3.2.0 | GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-110857 | < 3.2.0 | GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs | HIGH 7.7 | 0.4 % | ||
| CVE-2026-110856 | < 3.2.0 | GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date | HIGH 8.7 | 0.3 % | ||
| CVE-2026-110855 | < 3.2.0 | GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name | HIGH 7.1 | 0.3 % | ||
| CVE-2026-100689 | < 3.1.62 | GitPython before 3.1.62 Path Traversal via gitmodules path | HIGH 8.7 | 0.4 % | ||
| CVE-2026-87819 | < 3.1.60 | GitPython before 3.1.60 Denial of Service via ReDoS | HIGH 8.7 | 0.5 % | ||
| CVE-2026-87818 | 3.1.59 – < 3.1.60 | GitPython 3.1.59 Local File Content Oracle via --no-index | HIGH 7.1 | 0.4 % | ||
| CVE-2026-87817 | < 3.1.60 | GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation | HIGH 8.7 | 0.4 % | ||
| CVE-2026-78679 | < 3.1.59 | GitPython before 3.1.59 Arbitrary File Read via TagReference.create | HIGH 7.1 | 0.3 % | ||
| CVE-2026-78678 | < 3.1.59 | GitPython before 3.1.59 Arbitrary File Read via Repo.blame() | HIGH 7.1 | 0.4 % | ||
| CVE-2026-78677 | < 3.1.59 | GitPython before 3.1.59 Path Traversal via separate-git-dir | HIGH 8.7 | 0.7 % | ||
| CVE-2026-78676 | < 3.1.59 | GitPython before 3.1.59 Remote Code Execution via Config Injection | CRITICAL 9.3 | 0.8 % | ||
| CVE-2026-78675 | < 3.1.59 | GitPython before 3.1.59 Local File Content Disclosure via .gitmodules | HIGH 8.6 | 0.2 % | ||
| CVE-2026-76222 | < 3.1.58 | GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name | HIGH 8.4 | 0.4 % | ||
| CVE-2026-76221 | < 3.1.58 | GitPython before 3.1.58 Config Injection via option-name | HIGH 8.7 | 0.8 % | ||
| CVE-2026-76220 | < 3.1.58 | GitPython before 3.1.58 Command Execution via split_single_char_options | HIGH 8.7 | 0.9 % | ||
| CVE-2026-76219 | < 3.1.58 | GitPython before 3.1.58 Arbitrary File Overwrite via read-tree | HIGH 7.2 | 0.5 % | ||
| CVE-2026-76218 | < 3.1.58 | GitPython before 3.1.58 Remote Code Execution via Repo.init | HIGH 7.7 | 0.8 % | ||
| CVE-2026-76217 | < 3.1.58 | GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file | HIGH 7.1 | 0.4 % | ||
| CVE-2026-73625 | < 3.1.54 | GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling | HIGH 8.7 | 0.9 % | ||
| CVE-2026-73624 | < 3.1.54 | GitPython before 3.1.54 Arbitrary File Overwrite via diff | HIGH 7.2 | 0.6 % | ||
| CVE-2026-73623 | < 3.1.54 | GitPython before 3.1.54 Remote Code Execution via --template | HIGH 7.7 | 0.8 % | ||
| CVE-2026-73622 | < 3.1.55 | GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() | HIGH 8.7 | 0.5 % | ||
| CVE-2026-73621 | < 3.1.56 | GitPython before 3.1.56 Arbitrary File Truncation via Commit.count | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-73620 | < 3.1.57 | GitPython before 3.1.57 Arbitrary File Overwrite and Read | HIGH 7.2 | 0.6 % | ||
| CVE-2026-73619 | < 3.1.57 | GitPython before 3.1.57 Arbitrary File Read via Repo.archive() | HIGH 7.1 | 0.4 % | ||
| CVE-2026-69097 | < 3.1.53 | GitPython before 3.1.53 Config Injection via Submodule Names | HIGH 7.3 | 0.3 % | ||
| CVE-2026-67326 | < 3.1.50 | GitPython before 3.1.50 Newline Injection via config_writer section | HIGH 7.3 | 0.3 % | ||
| CVE-2026-67324 | 3.1.50 – < 3.1.51 | GitPython 3.1.50 Authentication Bypass via Joined Short Options | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-67323 | < 3.1.51 | GitPython before 3.1.51 Command Injection via unguarded Git options | HIGH 8.6 | 1.3 % | ||
| CVE-2026-67322 | < 3.1.52 | GitPython before 3.1.52 Environment Variable Exfiltration via clone_from | HIGH 8.7 | 0.3 % | ||
| CVE-2026-67325 | < 3.1.51 | GitPython before 3.1.51 Command Injection via option prefix abbreviation | HIGH 8.7 | 2.2 % | ||
| CVE-2026-44243 | < 3.1.48 | GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository | HIGH 7.8 | 0.4 % | ||
| CVE-2026-44244 | < 3.1.49 | GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath | HIGH 7.8 | 0.2 % | ||
| CVE-2026-42284 | < 3.1.47 | GitPython: Unsafe option check validates multi_options before shlex.split transforms it | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-42215 | >= 3.1.30, < 3.1.47 | GitPython: Command injection via Git options bypass | HIGH 8.8 | 0.7 % | ||
| CVE-2024-22190 | < 3.1.41 | Untrusted search path under some conditions on Windows allows arbitrary code execution | HIGH 7.8 | 0.3 % | ||
| CVE-2023-41040 | < 3.1.37 | GitPython blind local file inclusion | MEDIUM 6.5 | 1.1 % | ||
| CVE-2023-40590 | <= 3.1.32 | Untrusted search path on Windows systems leading to arbitrary code execution | HIGH 7.8 | 0.5 % |