Product by Gitpython-developers
GitPython
42 known vulnerabilities in GitPython (Gitpython-developers), 0 of them actively exploited (CISA KEV).
Key figures
42
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-67325 | GitPython before 3.1.51 Command Injection via option prefix abbreviation | 8.8 | |
| High | CVE-2026-67323 | GitPython before 3.1.51 Command Injection via unguarded Git options | 8.4 | |
| Critical | CVE-2026-78676 | GitPython before 3.1.59 Remote Code Execution via Config Injection | 9.8 | |
| High | CVE-2026-76220 | GitPython before 3.1.58 Command Execution via split_single_char_options | 8.8 | |
| High | CVE-2026-73625 | GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling | 8.8 | |
| High | CVE-2026-73623 | GitPython before 3.1.54 Remote Code Execution via --template | 8.8 | |
| High | CVE-2026-76221 | GitPython before 3.1.58 Config Injection via option-name | 8.8 | |
| Critical | CVE-2026-67324 | GitPython 3.1.50 Authentication Bypass via Joined Short Options | 9.8 | |
| Critical | CVE-2026-110858 | GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec | 8.1 | |
| High | CVE-2026-78677 | GitPython before 3.1.59 Path Traversal via separate-git-dir | 7.5 | |
| High | CVE-2026-76218 | GitPython before 3.1.58 Remote Code Execution via Repo.init | 7.5 | |
| High | CVE-2026-87819 | GitPython before 3.1.60 Denial of Service via ReDoS | 7.5 | |
| High | CVE-2026-42215 | GitPython: Command injection via Git options bypass | 8.8 | |
| High | CVE-2026-100689 | GitPython before 3.1.62 Path Traversal via gitmodules path | 5.9 | |
| High | CVE-2026-110859 | GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name | 7.5 | |
| High | CVE-2026-73622 | GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() | 7.5 | |
| High | CVE-2026-73620 | GitPython before 3.1.57 Arbitrary File Overwrite and Read | 8.1 | |
| High | CVE-2026-76219 | GitPython before 3.1.58 Arbitrary File Overwrite via read-tree | 8.1 | |
| High | CVE-2026-87817 | GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation | 8.8 | |
| High | CVE-2026-73624 | GitPython before 3.1.54 Arbitrary File Overwrite via diff | 8.1 | |
| High | CVE-2026-110856 | GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date | 7.5 | |
| High | CVE-2026-110857 | GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs | 7.5 | |
| High | CVE-2026-76222 | GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name | 8.2 | |
| Critical | CVE-2026-42284 | GitPython: Unsafe option check validates multi_options before shlex.split transforms it | 8.1 | |
| High | CVE-2026-114145 | GitPython validates a submodule's ".git" path only after cloning into it (RCE) | 7.5 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 30sans-atrisk-mail,