# cve.now: Gitpython-developers

The newest entries naming Gitpython-developers as an affected vendor (up to 200), of 42 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-114145](https://cve.now/CVE-2026-114145.md): GitPython validates a submodule's ".git" path only after cloning into it (RCE) (CVSS 7.5)
- [CVE-2026-110860](https://cve.now/CVE-2026-110860.md): GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move() (CVSS 6.9)
- [CVE-2026-110859](https://cve.now/CVE-2026-110859.md): GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name (CVSS 8.7)
- [CVE-2026-110858](https://cve.now/CVE-2026-110858.md): GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec (CVSS 9.2)
- [CVE-2026-110857](https://cve.now/CVE-2026-110857.md): GitPython before 3.2.0 Command Execution via ls\_remote ext:: URLs (CVSS 7.7)
- [CVE-2026-110856](https://cve.now/CVE-2026-110856.md): GitPython before 3.2.0 ReDoS via \_re\_actor\_epoch in parse\_actor\_and\_date (CVSS 8.7)
- [CVE-2026-110855](https://cve.now/CVE-2026-110855.md): GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name (CVSS 7.1)
- [CVE-2026-100689](https://cve.now/CVE-2026-100689.md): GitPython before 3.1.62 Path Traversal via gitmodules path (CVSS 8.7)
- [CVE-2026-87819](https://cve.now/CVE-2026-87819.md): GitPython before 3.1.60 Denial of Service via ReDoS (CVSS 8.7)
- [CVE-2026-87818](https://cve.now/CVE-2026-87818.md): GitPython 3.1.59 Local File Content Oracle via --no-index (CVSS 7.1)
- [CVE-2026-87817](https://cve.now/CVE-2026-87817.md): GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation (CVSS 8.7)
- [CVE-2026-78679](https://cve.now/CVE-2026-78679.md): GitPython before 3.1.59 Arbitrary File Read via TagReference.create (CVSS 7.1)
- [CVE-2026-78678](https://cve.now/CVE-2026-78678.md): GitPython before 3.1.59 Arbitrary File Read via Repo.blame() (CVSS 7.1)
- [CVE-2026-78677](https://cve.now/CVE-2026-78677.md): GitPython before 3.1.59 Path Traversal via separate-git-dir (CVSS 8.7)
- [CVE-2026-78676](https://cve.now/CVE-2026-78676.md): GitPython before 3.1.59 Remote Code Execution via Config Injection (CVSS 9.3)
- [CVE-2026-78675](https://cve.now/CVE-2026-78675.md): GitPython before 3.1.59 Local File Content Disclosure via .gitmodules (CVSS 8.6)
- [CVE-2026-76222](https://cve.now/CVE-2026-76222.md): GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name (CVSS 8.4)
- [CVE-2026-76221](https://cve.now/CVE-2026-76221.md): GitPython before 3.1.58 Config Injection via option-name (CVSS 8.7)
- [CVE-2026-76220](https://cve.now/CVE-2026-76220.md): GitPython before 3.1.58 Command Execution via split\_single\_char\_options (CVSS 8.7)
- [CVE-2026-76219](https://cve.now/CVE-2026-76219.md): GitPython before 3.1.58 Arbitrary File Overwrite via read-tree (CVSS 7.2)
- [CVE-2026-76218](https://cve.now/CVE-2026-76218.md): GitPython before 3.1.58 Remote Code Execution via Repo.init (CVSS 7.7)
- [CVE-2026-76217](https://cve.now/CVE-2026-76217.md): GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file (CVSS 7.1)
- [CVE-2026-73625](https://cve.now/CVE-2026-73625.md): GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling (CVSS 8.7)
- [CVE-2026-73624](https://cve.now/CVE-2026-73624.md): GitPython before 3.1.54 Arbitrary File Overwrite via diff (CVSS 7.2)
- [CVE-2026-73623](https://cve.now/CVE-2026-73623.md): GitPython before 3.1.54 Remote Code Execution via --template (CVSS 7.7)
- [CVE-2026-73622](https://cve.now/CVE-2026-73622.md): GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() (CVSS 8.7)
- [CVE-2026-73621](https://cve.now/CVE-2026-73621.md): GitPython before 3.1.56 Arbitrary File Truncation via Commit.count (CVSS 5.3)
- [CVE-2026-73620](https://cve.now/CVE-2026-73620.md): GitPython before 3.1.57 Arbitrary File Overwrite and Read (CVSS 7.2)
- [CVE-2026-73619](https://cve.now/CVE-2026-73619.md): GitPython before 3.1.57 Arbitrary File Read via Repo.archive() (CVSS 7.1)
- [CVE-2026-69097](https://cve.now/CVE-2026-69097.md): GitPython before 3.1.53 Config Injection via Submodule Names (CVSS 7.3)
- [CVE-2026-67326](https://cve.now/CVE-2026-67326.md): GitPython before 3.1.50 Newline Injection via config\_writer section (CVSS 7.3)
- [CVE-2026-67324](https://cve.now/CVE-2026-67324.md): GitPython 3.1.50 Authentication Bypass via Joined Short Options (CVSS 9.3)
- [CVE-2026-67323](https://cve.now/CVE-2026-67323.md): GitPython before 3.1.51 Command Injection via unguarded Git options (CVSS 8.6)
- [CVE-2026-67322](https://cve.now/CVE-2026-67322.md): GitPython before 3.1.52 Environment Variable Exfiltration via clone\_from (CVSS 8.7)
- [CVE-2026-67325](https://cve.now/CVE-2026-67325.md): GitPython before 3.1.51 Command Injection via option prefix abbreviation (CVSS 8.7)
- [CVE-2026-44243](https://cve.now/CVE-2026-44243.md): GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository (CVSS 7.8)
- [CVE-2026-44244](https://cve.now/CVE-2026-44244.md): GitPython: Newline injection in config\_writer().set\_value() enables RCE via core.hooksPath (CVSS 7.8)
- [CVE-2026-42284](https://cve.now/CVE-2026-42284.md): GitPython: Unsafe option check validates multi\_options before shlex.split transforms it (CVSS 8.1)
- [CVE-2026-42215](https://cve.now/CVE-2026-42215.md): GitPython: Command injection via Git options bypass (CVSS 8.8)
- [CVE-2024-22190](https://cve.now/CVE-2024-22190.md): Untrusted search path under some conditions on Windows allows arbitrary code execution (CVSS 7.8)
- [CVE-2023-41040](https://cve.now/CVE-2023-41040.md): GitPython blind local file inclusion (CVSS 4.0)
- [CVE-2023-40590](https://cve.now/CVE-2023-40590.md): Untrusted search path on Windows systems leading to arbitrary code execution (CVSS 7.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/gitpython-developers
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.