EUVD-2026-74845
GHSA-qpf5-3wfw-fh7q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered malformed commit requires no auth or interaction; sole impact is availability exhaustion via CPU starvation.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.
AnalysisAI
Regular expression denial of service in GitPython before 3.1.60 allows unauthenticated remote attackers to exhaust server CPU resources by supplying a crafted commit with a malformed author or committer field. The vulnerable regex Actor.name_email_regex exhibits quadratic backtracking when processing an unterminated angle bracket in the author string, stalling affected processes for over two minutes per commit access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to introduce a git commit object with a crafted author or committer field (containing an unterminated angle bracket) into a repository that the target application reads via GitPython. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) scores 8.7 and reflects that no authentication or interaction is required to deliver the payload - only the ability to introduce a malformed commit into a repository the target application reads. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade GitPython to version 3.1.60 or later; this is the vendor-confirmed patched release per the GitHub Security Advisory at https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running GitPython by checking application dependencies in package managers (pip show gitpython, requirements.txt, poetry.lock, setup.py) and CI/CD platform configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
Command injection in GitPython 3.1.30-3.1.46 allows remote authenticated attackers to execute arbitrary commands via und
Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using
Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today