Gitpython Developers

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-78676	Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config values: a dormant crafted value is silently rewritten into a live directive such as core.hooksPath whenever GitPython performs any unrelated config write. An attacker who can seed a malicious config value can thereby point hook execution at attacker-controlled code, gaining code execution the next time a hook-invoking git operation runs. Reported by VulnCheck (CWE-88) with a CVSS 4.0 base of 9.3; no public exploit or CISA KEV listing is identified at time of analysis.	CRITICAL	9.3	0.4%	47	PoC
CVE-2026-76220	Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using a single-character kwarg combined with split_single_char_options=False, causing git's short-option parser to interpret a smuggled joined token as --upload-pack=<cmd>. This is a second-order incomplete-fix bypass of the previously patched GHSA-r9mr-m37c-5fr3, affecting all guarded methods including clone_from, fetch, pull, push, ls_remote, iter_commits, blame, and archive. A working proof-of-concept is publicly available in the upstream GitHub Security Advisory GHSA-wvpp-8hx9-p66j; no CISA KEV listing is present at time of analysis, but the public PoC significantly lowers the exploitation bar.	HIGH	8.7	0.5%	44	PoC
CVE-2026-78677	Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. The library's clone operations omit `--separate-git-dir` from the `unsafe_git_clone_options` blocklist, so any application that passes attacker-controlled values to `Repo.clone_from()` or `Repo.clone()` allows git to redirect repository metadata to an arbitrary filesystem path. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the path-traversal primitive combined with git-hook execution capability produces a realistic high-integrity-impact scenario in exposed applications.	HIGH	8.7	0.4%	44	PoC
CVE-2026-76221	Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution via `core.sshCommand` or `core.hooksPath`. The option-name validator in `git/config.py` only blocks CR/LF/NUL, allowing `=`, `#`, and whitespace to pass unchecked; `write_section` then writes the option name verbatim, causing git to parse attacker-supplied content as a valid directive. Exploitation requires a calling application to forward attacker-influenced input to `config_writer.set_value()` as the option-name argument, and a proof-of-concept is publicly confirmed in the vendor GHSA advisory. No CISA KEV listing is present at time of analysis.	HIGH	8.7	0.4%	44
CVE-2026-87817	Arbitrary code execution in GitPython before 3.1.60 is possible when a victim application calls index.commit() on an attacker-controlled repository. The root cause is insufficient validation of the git directory location: GitPython trusts tracked files such as gitdir, commondir, and HEAD to resolve the effective git directory, allowing a crafted repository to redirect that resolution to an attacker-controlled path containing a malicious pre-commit hook. No public exploit has been identified at time of analysis, but the attack is realistic in any Python-based DevOps pipeline, CI/CD system, or tooling that opens and commits to externally sourced repositories.	HIGH	8.7	0.3%	44
CVE-2026-87819	Regular expression denial of service in GitPython before 3.1.60 allows unauthenticated remote attackers to exhaust server CPU resources by supplying a crafted commit with a malformed author or committer field. The vulnerable regex Actor.name_email_regex exhibits quadratic backtracking when processing an unterminated angle bracket in the author string, stalling affected processes for over two minutes per commit access. Any application that reads attacker-influenced git repositories using GitPython is exposed; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.	HIGH	8.7	0.3%	44
CVE-2026-78675	GitPython before 3.1.59 discloses local file content through exception messages when parsing .gitmodules files that contain [include] directives, because the library fails to disable the merge_includes feature in GitConfigParser. An attacker who can introduce a malicious .gitmodules into a repository processed by a vulnerable GitPython instance can cause the first line of any locally readable file to appear verbatim in a MissingSectionHeaderError exception when repo.submodules is accessed. No active exploitation has been confirmed (absent from CISA KEV) and no public POC is referenced in available intelligence; a vendor-released patch exists in version 3.1.59.	HIGH	8.6	0.1%	43	PoC
CVE-2026-76222	Path traversal in GitPython before 3.1.58 allows remote attackers who control a Git repository to create fully initialized, attacker-controlled Git repositories at arbitrary filesystem paths outside the intended clone directory. GitPython's independent submodule implementation reads submodule names from .gitmodules without any validation - a check that core Git added years ago in response to CVE-2018-11235 - and passes the raw, traversal-containing name directly to os.makedirs() and git clone. A proof-of-concept with Docker-based reproduction is publicly documented in GHSA-hmq2-w58f-27jc; no CISA KEV listing is present at time of analysis, indicating exploitation is not yet confirmed as widespread.	HIGH	8.4	0.3%	42	PoC
CVE-2026-76218	Remote code execution in GitPython before 3.1.58 is reachable through Repo.init(), which forwards all keyword arguments verbatim to git init without any unsafe-option validation. An attacker who can influence the template kwarg can point it at an attacker-controlled directory containing malicious git hooks; git copies those hooks into the newly initialized repository, and the next git operation (e.g., a commit) triggers arbitrary code execution at the privilege level of the host process. A proof-of-concept demonstrating the full hook-copy-and-fire chain has been publicly released and independently reproduced per the GHSA advisory, and upstream fix code is available in PR #2204 and commit d9ddb55bdc66, targeting the 3.1.58 release.	HIGH	7.7	0.5%	39	PoC
CVE-2026-76219	Arbitrary file overwrite in GitPython before 3.1.58 allows attackers who can influence treeish arguments passed to IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree to clobber any file writable by the host process with a valid git-index blob. The three affected methods in git/index/base.py forward caller-controlled strings directly to git read-tree with no option sanitization and no -- argument terminator, enabling injection of --index-output=<path>; git's last-occurrence-wins behavior lets the injected flag override the library's internal temp path. A proof-of-concept is publicly documented in GHSA-4gmw-gg2m-w46p; no CISA KEV listing was present at time of analysis.	HIGH	7.2	0.3%	36	PoC
CVE-2026-76217	Arbitrary file read in GitPython versions through 3.1.57 allows low-privileged users who can influence kwargs passed to IndexFile.remove() or Head.checkout() to exfiltrate the complete contents of any file readable by the hosting process. The attack chains two unsanitized Git flags - --pathspec-from-file and --pathspec-file-nul - causing Git to return verbatim file contents through a GitCommandError exception that GitPython surfaces in-band. A detailed proof of concept is publicly available in the vendor GHSA advisory; this vulnerability is not currently listed in CISA KEV.	HIGH	7.1	0.3%	36	PoC
CVE-2026-78679	Arbitrary file read in GitPython before 3.1.59 allows low-privileged remote attackers to exfiltrate sensitive files by supplying a crafted reference argument to TagReference.create(). The vulnerability arises because a positional reference parameter (e.g., '--file=/etc/passwd') bypasses the library's built-in unsafe option guard, causing git to interpret the value as a flag and return the targeted file's contents embedded in the annotated tag message. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 7.1 with high confidentiality impact reflects genuine disclosure risk in any application that exposes this code path to user-controlled input.	HIGH	7.1	0.2%	36	PoC
CVE-2026-78678	Arbitrary file read in GitPython versions before 3.1.59 exposes sensitive filesystem content to low-privileged network attackers through an incomplete argument-injection guard. The unsafe_git_revision_options denylist in Repo.blame() omits the --contents and -S git options, allowing attackers to supply revision values such as --contents=/etc/passwd and receive the target file's contents embedded in the blame output. No public exploit has been identified at time of analysis, but the bypass is conceptually trivial - a crafted string is all that is required once access to the blame API is established.	HIGH	7.1	0.2%	36	PoC
CVE-2026-87818	Argument injection in GitPython 3.1.59's high-level diff API allows low-privileged remote attackers to read arbitrary filesystem paths by passing the unsanitized `--no-index` flag to the underlying git diff command. By chaining `--no-index` with the `-I`/`--ignore-matching-lines` regex filter, an attacker can construct a content-dependent Boolean oracle - issuing repeated queries that distinguish between regex match and mismatch responses to recover single-line secrets from local files. No active exploitation has been confirmed (not in CISA KEV), but the technique is deterministic and requires only authenticated API access. Patch-upgraded version 3.1.60 is available.	HIGH	7.1	0.2%	36

CVE-2026-78676

Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config values: a dormant crafted value is silently rewritten into a live directive such as core.hooksPath whenever GitPython performs any unrelated config write. An attacker who can seed a malicious config value can thereby point hook execution at attacker-controlled code, gaining code execution the next time a hook-invoking git operation runs. Reported by VulnCheck (CWE-88) with a CVSS 4.0 base of 9.3; no public exploit or CISA KEV listing is identified at time of analysis.

CRITICAL

9.3

0.4%

47

PoC

CVE-2026-76220

Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using a single-character kwarg combined with split_single_char_options=False, causing git's short-option parser to interpret a smuggled joined token as --upload-pack=<cmd>. This is a second-order incomplete-fix bypass of the previously patched GHSA-r9mr-m37c-5fr3, affecting all guarded methods including clone_from, fetch, pull, push, ls_remote, iter_commits, blame, and archive. A working proof-of-concept is publicly available in the upstream GitHub Security Advisory GHSA-wvpp-8hx9-p66j; no CISA KEV listing is present at time of analysis, but the public PoC significantly lowers the exploitation bar.

HIGH

8.7

0.5%

44

PoC

CVE-2026-78677

Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. The library's clone operations omit `--separate-git-dir` from the `unsafe_git_clone_options` blocklist, so any application that passes attacker-controlled values to `Repo.clone_from()` or `Repo.clone()` allows git to redirect repository metadata to an arbitrary filesystem path. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the path-traversal primitive combined with git-hook execution capability produces a realistic high-integrity-impact scenario in exposed applications.

HIGH

8.7

0.4%

44

PoC

CVE-2026-76221

Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution via `core.sshCommand` or `core.hooksPath`. The option-name validator in `git/config.py` only blocks CR/LF/NUL, allowing `=`, `#`, and whitespace to pass unchecked; `write_section` then writes the option name verbatim, causing git to parse attacker-supplied content as a valid directive. Exploitation requires a calling application to forward attacker-influenced input to `config_writer.set_value()` as the option-name argument, and a proof-of-concept is publicly confirmed in the vendor GHSA advisory. No CISA KEV listing is present at time of analysis.

HIGH

8.7

0.4%

44

CVE-2026-87817

Arbitrary code execution in GitPython before 3.1.60 is possible when a victim application calls index.commit() on an attacker-controlled repository. The root cause is insufficient validation of the git directory location: GitPython trusts tracked files such as gitdir, commondir, and HEAD to resolve the effective git directory, allowing a crafted repository to redirect that resolution to an attacker-controlled path containing a malicious pre-commit hook. No public exploit has been identified at time of analysis, but the attack is realistic in any Python-based DevOps pipeline, CI/CD system, or tooling that opens and commits to externally sourced repositories.

HIGH

8.7

0.3%

44

CVE-2026-87819

Regular expression denial of service in GitPython before 3.1.60 allows unauthenticated remote attackers to exhaust server CPU resources by supplying a crafted commit with a malformed author or committer field. The vulnerable regex Actor.name_email_regex exhibits quadratic backtracking when processing an unterminated angle bracket in the author string, stalling affected processes for over two minutes per commit access. Any application that reads attacker-influenced git repositories using GitPython is exposed; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

HIGH

8.7

0.3%

44

CVE-2026-78675

GitPython before 3.1.59 discloses local file content through exception messages when parsing .gitmodules files that contain [include] directives, because the library fails to disable the merge_includes feature in GitConfigParser. An attacker who can introduce a malicious .gitmodules into a repository processed by a vulnerable GitPython instance can cause the first line of any locally readable file to appear verbatim in a MissingSectionHeaderError exception when repo.submodules is accessed. No active exploitation has been confirmed (absent from CISA KEV) and no public POC is referenced in available intelligence; a vendor-released patch exists in version 3.1.59.

HIGH

8.6

0.1%

43

PoC

CVE-2026-76222

Path traversal in GitPython before 3.1.58 allows remote attackers who control a Git repository to create fully initialized, attacker-controlled Git repositories at arbitrary filesystem paths outside the intended clone directory. GitPython's independent submodule implementation reads submodule names from .gitmodules without any validation - a check that core Git added years ago in response to CVE-2018-11235 - and passes the raw, traversal-containing name directly to os.makedirs() and git clone. A proof-of-concept with Docker-based reproduction is publicly documented in GHSA-hmq2-w58f-27jc; no CISA KEV listing is present at time of analysis, indicating exploitation is not yet confirmed as widespread.

HIGH

8.4

0.3%

42

PoC

CVE-2026-76218

Remote code execution in GitPython before 3.1.58 is reachable through Repo.init(), which forwards all keyword arguments verbatim to git init without any unsafe-option validation. An attacker who can influence the template kwarg can point it at an attacker-controlled directory containing malicious git hooks; git copies those hooks into the newly initialized repository, and the next git operation (e.g., a commit) triggers arbitrary code execution at the privilege level of the host process. A proof-of-concept demonstrating the full hook-copy-and-fire chain has been publicly released and independently reproduced per the GHSA advisory, and upstream fix code is available in PR #2204 and commit d9ddb55bdc66, targeting the 3.1.58 release.

HIGH

7.7

0.5%

39

PoC

CVE-2026-76219

Arbitrary file overwrite in GitPython before 3.1.58 allows attackers who can influence treeish arguments passed to IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree to clobber any file writable by the host process with a valid git-index blob. The three affected methods in git/index/base.py forward caller-controlled strings directly to git read-tree with no option sanitization and no -- argument terminator, enabling injection of --index-output=<path>; git's last-occurrence-wins behavior lets the injected flag override the library's internal temp path. A proof-of-concept is publicly documented in GHSA-4gmw-gg2m-w46p; no CISA KEV listing was present at time of analysis.

HIGH

7.2

0.3%

36

PoC

CVE-2026-76217

Arbitrary file read in GitPython versions through 3.1.57 allows low-privileged users who can influence kwargs passed to IndexFile.remove() or Head.checkout() to exfiltrate the complete contents of any file readable by the hosting process. The attack chains two unsanitized Git flags - --pathspec-from-file and --pathspec-file-nul - causing Git to return verbatim file contents through a GitCommandError exception that GitPython surfaces in-band. A detailed proof of concept is publicly available in the vendor GHSA advisory; this vulnerability is not currently listed in CISA KEV.

HIGH

7.1

0.3%

36

PoC

CVE-2026-78679

Arbitrary file read in GitPython before 3.1.59 allows low-privileged remote attackers to exfiltrate sensitive files by supplying a crafted reference argument to TagReference.create(). The vulnerability arises because a positional reference parameter (e.g., '--file=/etc/passwd') bypasses the library's built-in unsafe option guard, causing git to interpret the value as a flag and return the targeted file's contents embedded in the annotated tag message. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 7.1 with high confidentiality impact reflects genuine disclosure risk in any application that exposes this code path to user-controlled input.

HIGH

7.1

0.2%

36

PoC

CVE-2026-78678

Arbitrary file read in GitPython versions before 3.1.59 exposes sensitive filesystem content to low-privileged network attackers through an incomplete argument-injection guard. The unsafe_git_revision_options denylist in Repo.blame() omits the --contents and -S git options, allowing attackers to supply revision values such as --contents=/etc/passwd and receive the target file's contents embedded in the blame output. No public exploit has been identified at time of analysis, but the bypass is conceptually trivial - a crafted string is all that is required once access to the blame API is established.

HIGH

7.1

0.2%

36

PoC

CVE-2026-87818

Argument injection in GitPython 3.1.59's high-level diff API allows low-privileged remote attackers to read arbitrary filesystem paths by passing the unsanitized `--no-index` flag to the underlying git diff command. By chaining `--no-index` with the `-I`/`--ignore-matching-lines` regex filter, an attacker can construct a content-dependent Boolean oracle - issuing repeated queries that distinguish between regex match and mismatch responses to recover single-line secrets from local files. No active exploitation has been confirmed (not in CISA KEV), but the technique is deterministic and requires only authenticated API access. Patch-upgraded version 3.1.60 is available.

HIGH

7.1

0.2%

36

Severity Breakdown

Monthly CVE Trend

Affected Products (2)

Top Risky CVEs