What’s Vulnerable › Products

gitpython-developers GitPython vulnerabilities

44 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 39 published in the last 12 months.

Check whether your gitpython-developers GitPython version is affected

Latest gitpython-developers GitPython vulnerabilities

• CVE-2026-114145 — GitPython validates a submodule's ".git" path only after cloning into it (RCE) (CVSS 7.5)
• CVE-2026-110860 — GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move() (CVSS 6.1)
• CVE-2026-110859 — GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name (CVSS 7.5)
• CVE-2026-110858 — GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec (CVSS 8.1)
• CVE-2026-110857 — GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs (CVSS 7.5)
• CVE-2026-110856 — GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date (CVSS 7.5)
• CVE-2026-110855 — GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name (CVSS 6.5)
• CVE-2026-100689 — GitPython before 3.1.62 Path Traversal via gitmodules path (CVSS 5.9)
• CVE-2026-87819 — GitPython before 3.1.60 Denial of Service via ReDoS (CVSS 7.5)
• CVE-2026-87818 — GitPython 3.1.59 Local File Content Oracle via --no-index (CVSS 6.5)
• CVE-2026-87817 — GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation (CVSS 8.8)
• CVE-2026-78679 — GitPython before 3.1.59 Arbitrary File Read via TagReference.create (CVSS 6.5)
• CVE-2026-78678 — GitPython before 3.1.59 Arbitrary File Read via Repo.blame() (CVSS 6.5)
• CVE-2026-78677 — GitPython before 3.1.59 Path Traversal via separate-git-dir (CVSS 7.5)
• CVE-2026-78676 — GitPython before 3.1.59 Remote Code Execution via Config Injection (CVSS 9.8)
• CVE-2026-78675 — GitPython before 3.1.59 Local File Content Disclosure via .gitmodules (CVSS 7.8)
• CVE-2026-76222 — GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name (CVSS 8.2)
• CVE-2026-76221 — GitPython before 3.1.58 Config Injection via option-name (CVSS 8.8)
• CVE-2026-76220 — GitPython before 3.1.58 Command Execution via split_single_char_options (CVSS 8.8)
• CVE-2026-76219 — GitPython before 3.1.58 Arbitrary File Overwrite via read-tree (CVSS 8.1)
• CVE-2026-76218 — GitPython before 3.1.58 Remote Code Execution via Repo.init (CVSS 8.8)
• CVE-2026-76217 — GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file (CVSS 6.5)
• CVE-2026-73625 — GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling (CVSS 8.8)
• CVE-2026-73624 — GitPython before 3.1.54 Arbitrary File Overwrite via diff (CVSS 8.1)
• CVE-2026-73623 — GitPython before 3.1.54 Remote Code Execution via --template (CVSS 8.8)