Gitpython-developers vulnerabilities
42 CVEs and advisories name Gitpython-developers as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-114145GitPython validates a submodule's ".git" path only after cloning into it (RCE)
- CVE-2026-110860GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()
- CVE-2026-110859GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name
- CVE-2026-110858GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
- CVE-2026-110857GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs
- CVE-2026-110856GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date
- CVE-2026-110855GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name
- CVE-2026-100689GitPython before 3.1.62 Path Traversal via gitmodules path
- CVE-2026-87819GitPython before 3.1.60 Denial of Service via ReDoS
- CVE-2026-87818GitPython 3.1.59 Local File Content Oracle via --no-index
- CVE-2026-87817GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
- CVE-2026-78679GitPython before 3.1.59 Arbitrary File Read via TagReference.create
- CVE-2026-78678GitPython before 3.1.59 Arbitrary File Read via Repo.blame()
- CVE-2026-78677GitPython before 3.1.59 Path Traversal via separate-git-dir
- CVE-2026-78676GitPython before 3.1.59 Remote Code Execution via Config Injection
- CVE-2026-78675GitPython before 3.1.59 Local File Content Disclosure via .gitmodules
- CVE-2026-76222GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name
- CVE-2026-76221GitPython before 3.1.58 Config Injection via option-name
- CVE-2026-76220GitPython before 3.1.58 Command Execution via split_single_char_options
- CVE-2026-76219GitPython before 3.1.58 Arbitrary File Overwrite via read-tree
- CVE-2026-76218GitPython before 3.1.58 Remote Code Execution via Repo.init
- CVE-2026-76217GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file
- CVE-2026-73625GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling
- CVE-2026-73624GitPython before 3.1.54 Arbitrary File Overwrite via diff
- CVE-2026-73623GitPython before 3.1.54 Remote Code Execution via --template
- CVE-2026-73622GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()
- CVE-2026-73621GitPython before 3.1.56 Arbitrary File Truncation via Commit.count
- CVE-2026-73620GitPython before 3.1.57 Arbitrary File Overwrite and Read
- CVE-2026-73619GitPython before 3.1.57 Arbitrary File Read via Repo.archive()
- CVE-2026-69097GitPython before 3.1.53 Config Injection via Submodule Names