[ Vendor · 10 CVEs ]
gitpython-developers
CVEs affecting gitpython-developers published in the last 30 days, plus any gitpython-developers CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114145 | 21 Oct 2026 | CVSS 7.5 | GitPython validates a submodule's ".git" path only after cloning into it (RCE)GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an… | Fix |
| CVE-2026-110858 | 14 Oct 2026 | CVSS 8.1 | gitpython-developers GitPythonGitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword… | |
| CVE-2026-110859 | 14 Oct 2026 | CVSS 7.5 | gitpython-developers GitPythonGitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by… | |
| CVE-2026-110860 | 14 Oct 2026 | CVSS 6.1 | gitpython-developers GitPythonGitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not… | |
| CVE-2026-110855 | 14 Oct 2026 | CVSS 6.5 | gitpython-developers GitPythonGitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via… | |
| CVE-2026-110856 | 14 Oct 2026 | CVSS 7.5 | gitpython-developers GitPythonGitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on… | |
| CVE-2026-110857 | 14 Oct 2026 | CVSS 7.5 | gitpython-developers GitPythonGitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs… | |
| CVE-2026-100689 | 26 Sep 2026 | CVSS 5.9 | gitpython-developers GitPythonGitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix… | |
| CVE-2026-87819 | 9 Sep 2026 | CVSS 7.5 | GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsingGitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and… | Fix |
| CVE-2026-87817 | 9 Sep 2026 | CVSS 8.8 | GitPython: Repository content can impersonate the git directory, leading to arbitrary code executionGitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked… | Fix |