These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. The vulnerability exists due to insufficient input validation in the Head.checkout() method, which can lead to potential file reads via malicious branch names. Defenders should assess exposure and prioritize verificat [truncated]
GitPython 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), allowing an untrusted repository to corrupt the index and .gitmodules. Defenders should assess exposure, prioritize remediation, and verify affected systems. The vulnerability allows attackers to manipulate the Git repository, potentially leading to data corruption and unauthorized access. Affected systems should be ident [truncated]
GitPython 3.1.30 before 3.2.0 is vulnerable to command injection via Remote.pull() Refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports. This vulnerability allows remote code execution, potentially leading to unauthorized access and control of affected systems. Developers and administrators should asse [truncated]
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. This vulnerability affects GitPython deployments, particularly those using ext:: URLs in Git.ls_remote. Defenders should assess exposure and prioritize verification and remediation efforts to prevent potential command exe [truncated]
GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name. This vulnerability allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), omitting expand_vars=False when calling Git.polish_url(). The information disclosure vulnerability can lead to potential exposure of secrets in .git/modules directory names and DEBUG logs. Defenders sh [truncated]
GitPython clones a submodule into the repo's own `.git` directory before validating the path, allowing for code execution if the submodule's path is set to `.git/hooks`. This vulnerability affects GitPython installations that use submodules, particularly in environments where submodules are utilized, enabling attackers to execute code on the next Git operation (e.g., checkout). Defenders should assess exp [truncated]
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.
GitPython before 3.1.62 is vulnerable to a path traversal attack via the gitmodules path. This issue allows an attacker to create directories outside the repository working tree by manipulating the `path` field in a .gitmodules file. The vulnerability is fixed in GitPython 3.1.62. Affected users should assess exposure, verify if their versions are affected, and prioritize remediation. This vulnerability r [truncated]
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access. This vulnerability affects GitPython app [truncated]
GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.
CVE-2026-78679 is a high-severity vulnerability in GitPython before version 3.1.59. The vulnerability exists in the TagReference.create() method, where an attacker can supply a positional reference parameter to bypass the unsafe option guard, allowing for arbitrary file reads. This could lead to unauthorized access to sensitive information. The vulnerability has a CVSS score of 7.1 and is classified as HI [truncated]
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
GitPython, a Python library used to interact with Git repositories, is vulnerable to a local file content disclosure issue. This vulnerability arises from the library's failure to disable merge_includes when parsing .gitmodules files, allowing attackers to include arbitrary file paths via [include] directives. The vulnerability can be exploited by crafting a malicious .gitmodules file with include directi [truncated]
GitPython before version 3.1.58 is vulnerable to a path traversal attack due to improper validation of submodule names from .gitmodules files. This allows attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Users of GitPython should be aware of this vulnerability and take steps to mitigate it. The CVE record was published on 2026-08-19T14:17:48.603Z and [truncated]
CVE-2026-76220 is a command execution vulnerability in GitPython before version 3.1.58. The vulnerability exists in the check_unsafe_options guard, which can be bypassed by combining a single-character kwarg with split_single_char_options=False. This allows attackers to supply a crafted kwargs dictionary to guarded methods like clone_from, enabling arbitrary OS command execution at default allow_unsafe_op [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T14:17:48.187Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish st [truncated]
CVE-2026-76218 is a remote code execution vulnerability in GitPython before version 3.1.58. The vulnerability occurs in Repo.init, which forwards unsafe git options without validation. Attackers can exploit this by supplying a template parameter pointing to a directory with malicious git hooks, allowing arbitrary code execution when git operations are performed on the initialized repository. This vulnerab [truncated]
CVE-2026-73625 is a remote code execution vulnerability in GitPython versions before 3.1.54. The vulnerability can be exploited by supplying crafted option dictionaries to certain methods, allowing attackers to execute arbitrary OS commands via the --upload-pack parameter. This vulnerability affects GitPython users and administrators, who should prioritize patching to prevent potential remote code executi [truncated]
GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method. This vulnerability allows attackers to supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level. The vulnerability can be exploited by attackers to overwrite arbitrary files, potentially leading to a deni [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. CVE-2026-73623 is a high-severity vulnerability in GitPython, a Python library used to interact with Git repositories. The vulnerability is caused by an incomplete denylist in the unsafe_git_clone_options function, which allows attackers to execute arbitrary commands during clone operations. An attacker can exploit this vulnerability by s [truncated]
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. This vulnerability affects GitPython users who handle sensitive data or use GitPython in environments with untrusted input. The vulnerability is caused by the lack of proper input validation i [truncated]
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band. The CVE record was published on 2026-08-13T12:17:27.057Z and has not been modified since then. The NVD entry is cu [truncated]
The GitPython library before version 3.1.57 has an incomplete denylist in the unsafe_git_archive_options guard. This allows attackers to use --add-file and --add-virtual-file options with Repo.archive() to read arbitrary files from the filesystem and include them in the generated archive. Users of GitPython, especially those who use Repo.archive() functionality, should be aware of this vulnerability and t [truncated]
GitPython `<= 3.1.52` is vulnerable to a git-config section-name injection attack, allowing an attacker to inject arbitrary config directives, including `core.sshCommand`, and achieve remote code execution on the victim's next git operation. This vulnerability requires immediate attention from GitPython users, developers, and administrators to assess exposure and prioritize remediation due to the high sev [truncated]
GitPython, a Python library used to interact with Git repositories, is vulnerable to a newline injection attack in its config_writer() function. This vulnerability, tracked as CVE-2026-67326, allows attackers to inject arbitrary section headers into a Git repository's .git/config file. By exploiting this vulnerability, attackers can create a forged [core] section with a hooksPath pointing to attacker-cont [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:02.923Z and has not been modified since then. GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p ins [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:02.770Z and has not been modified since then. GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> when enforcing its default unsafe-option gate. An attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specifie [truncated]
GitPython before 3.1.51 is vulnerable to command injection via unguarded Git options in Repo.archive() and git.ls_remote(). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, which can cause Git to open and truncate an arbitrary file. This vulnerability affects developers and administrators using GitPython in their applications, potentially leading to arbi [truncated]
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The vulnerability allows an attacker who controls the clone URL to embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables. This issue affects GitPython users, developers, and administrators, who should be aware of this vulnerability and take necessary actio [truncated]
