These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
GitPython, a Python library used to interact with Git repositories, is vulnerable to a local file content disclosure issue. This vulnerability arises from the library's failure to disable merge_includes when parsing .gitmodules files, allowing attackers to include arbitrary file paths via [include] directives. The vulnerability can be exploited by crafting a malicious .gitmodules file with include directi [truncated]
GitPython before version 3.1.58 is vulnerable to a path traversal attack due to improper validation of submodule names from .gitmodules files. This allows attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Users of GitPython should be aware of this vulnerability and take steps to mitigate it. The CVE record was published on 2026-08-19T14:17:48.603Z and [truncated]
CVE-2026-76220 is a command execution vulnerability in GitPython before version 3.1.58. The vulnerability exists in the check_unsafe_options guard, which can be bypassed by combining a single-character kwarg with split_single_char_options=False. This allows attackers to supply a crafted kwargs dictionary to guarded methods like clone_from, enabling arbitrary OS command execution at default allow_unsafe_op [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T14:17:48.187Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish st [truncated]
CVE-2026-76218 is a remote code execution vulnerability in GitPython before version 3.1.58. The vulnerability occurs in Repo.init, which forwards unsafe git options without validation. Attackers can exploit this by supplying a template parameter pointing to a directory with malicious git hooks, allowing arbitrary code execution when git operations are performed on the initialized repository. This vulnerab [truncated]
CVE-2026-73625 is a remote code execution vulnerability in GitPython versions before 3.1.54. The vulnerability can be exploited by supplying crafted option dictionaries to certain methods, allowing attackers to execute arbitrary OS commands via the --upload-pack parameter. This vulnerability affects GitPython users and administrators, who should prioritize patching to prevent potential remote code executi [truncated]
CVE-2026-73624 is a high-severity vulnerability in GitPython versions before 3.1.54. The Diffable.diff method does not validate git options passed through kwargs, allowing attackers to overwrite arbitrary files via the --output argument. This issue requires verification of affected versions and exposure, and defenders should assess the impact on GitPython deployments. Affected systems may be vulnerable to [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. CVE-2026-73623 is a high-severity vulnerability in GitPython, a Python library used to interact with Git repositories. The vulnerability is caused by an incomplete denylist in the unsafe_git_clone_options function, which allows attackers to execute arbitrary commands during clone operations. An attacker can exploit this vulnerability by s [truncated]
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. This vulnerability affects GitPython users who handle sensitive data or use GitPython in environments with untrusted input. The vulnerability is caused by the lack of proper input validation i [truncated]
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band. The CVE record was published on 2026-08-13T12:17:27.057Z and has not been modified since then. The NVD entry is cu [truncated]
The GitPython library before version 3.1.57 has an incomplete denylist in the unsafe_git_archive_options guard. This allows attackers to use --add-file and --add-virtual-file options with Repo.archive() to read arbitrary files from the filesystem and include them in the generated archive. Users of GitPython, especially those who use Repo.archive() functionality, should be aware of this vulnerability and t [truncated]
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. This vulnerability enables attackers to inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh [truncated]
GitPython, a Python library used to interact with Git repositories, is vulnerable to a newline injection attack in its config_writer() function. This vulnerability, tracked as CVE-2026-67326, allows attackers to inject arbitrary section headers into a Git repository's .git/config file. By exploiting this vulnerability, attackers can create a forged [core] section with a hooksPath pointing to attacker-cont [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:02.923Z and has not been modified since then. GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p ins [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:02.770Z and has not been modified since then. GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> when enforcing its default unsafe-option gate. An attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specifie [truncated]
GitPython before 3.1.51 is vulnerable to command injection via unguarded Git options in Repo.archive() and git.ls_remote(). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, which can cause Git to open and truncate an arbitrary file. This vulnerability affects developers and administrators using GitPython in their applications, potentially leading to arbi [truncated]
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The vulnerability allows an attacker who controls the clone URL to embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables. This issue affects GitPython users, developers, and administrators, who should be aware of this vulnerability and take necessary actio [truncated]