gitpython-developers GitPython vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 20241
3. 202639

Newest CVEs

• CVE-2026-114145

  GitPython validates a submodule's ".git" path only after cloning into it (RCE)

  gitpython-developers · GitPython

  High7.5
• CVE-2026-110860

  GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()

  gitpython-developers · GitPython

  Medium6.9
• CVE-2026-110859

  GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name

  gitpython-developers · GitPython

  High8.7
• CVE-2026-110858

  GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec

  gitpython-developers · GitPython

  Critical9.2
• CVE-2026-110857

  GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs

  gitpython-developers · GitPython

  High7.7
• CVE-2026-110856

  GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

  gitpython-developers · GitPython

  High8.7
• CVE-2026-110855

  GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name

  gitpython-developers · GitPython

  High7.1
• CVE-2026-100689

  GitPython before 3.1.62 Path Traversal via gitmodules path

  gitpython-developers · GitPython

  High8.7
• CVE-2026-87819

  GitPython before 3.1.60 Denial of Service via ReDoS

  gitpython-developers · GitPython

  High8.7
• CVE-2026-87818

  GitPython 3.1.59 Local File Content Oracle via --no-index

  gitpython-developers · GitPython

  High7.1