{"items":[{"id":"CVE-2026-114145","published":"2026-10-21T20:35:06.548Z","updated":"2026-10-23T15:08:48.132Z","title":"GitPython validates a submodule's \".git\" path only after cloning into it (RCE)","severity":"HIGH","score":7.5,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-110860","published":"2026-10-14T22:52:44.690Z","updated":"2026-10-26T15:27:14.246Z","title":"GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()","severity":"MEDIUM","score":6.9,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-110859","published":"2026-10-14T22:52:43.585Z","updated":"2026-10-15T15:40:26.986Z","title":"GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-110858","published":"2026-10-14T22:52:42.217Z","updated":"2026-10-16T17:14:41.140Z","title":"GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec","severity":"CRITICAL","score":9.2,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-110857","published":"2026-10-14T22:52:40.373Z","updated":"2026-10-15T13:36:14.066Z","title":"GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs","severity":"HIGH","score":7.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-110856","published":"2026-10-14T22:52:38.541Z","updated":"2026-10-20T02:25:27.631Z","title":"GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2026-110855","published":"2026-10-14T22:52:34.854Z","updated":"2026-10-15T18:15:45.736Z","title":"GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name","severity":"HIGH","score":7.1,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-100689","published":"2026-09-26T13:23:48.759Z","updated":"2026-10-08T15:21:59.548Z","title":"GitPython before 3.1.62 Path Traversal via gitmodules path","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2026-87819","published":"2026-09-09T11:21:05.360Z","updated":"2026-10-08T15:25:57.646Z","title":"GitPython before 3.1.60 Denial of Service via ReDoS","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2026-87818","published":"2026-09-09T11:21:04.681Z","updated":"2026-10-08T15:25:57.055Z","title":"GitPython 3.1.59 Local File Content Oracle via --no-index","severity":"HIGH","score":7.1,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-87817","published":"2026-09-09T11:21:04.007Z","updated":"2026-10-08T15:25:56.195Z","title":"GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-78679","published":"2026-08-25T01:30:36.339Z","updated":"2026-10-08T15:25:09.730Z","title":"GitPython before 3.1.59 Arbitrary File Read via TagReference.create","severity":"HIGH","score":7.1,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-78678","published":"2026-08-25T01:30:35.582Z","updated":"2026-10-08T15:25:09.232Z","title":"GitPython before 3.1.59 Arbitrary File Read via Repo.blame()","severity":"HIGH","score":7.1,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-78677","published":"2026-08-25T01:30:34.719Z","updated":"2026-10-08T15:25:08.424Z","title":"GitPython before 3.1.59 Path Traversal via separate-git-dir","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00651,"kevAdded":null},{"id":"CVE-2026-78676","published":"2026-08-25T01:30:33.754Z","updated":"2026-10-08T15:25:07.826Z","title":"GitPython before 3.1.59 Remote Code Execution via Config Injection","severity":"CRITICAL","score":9.3,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2026-78675","published":"2026-08-25T01:30:32.739Z","updated":"2026-10-08T15:25:07.280Z","title":"GitPython before 3.1.59 Local File Content Disclosure via .gitmodules","severity":"HIGH","score":8.6,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-76222","published":"2026-08-19T14:02:05.596Z","updated":"2026-10-08T15:25:02.909Z","title":"GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name","severity":"HIGH","score":8.4,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2026-76221","published":"2026-08-19T14:02:04.795Z","updated":"2026-10-08T15:25:02.346Z","title":"GitPython before 3.1.58 Config Injection via option-name","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2026-76220","published":"2026-08-19T14:02:04.108Z","updated":"2026-10-08T15:25:01.788Z","title":"GitPython before 3.1.58 Command Execution via split_single_char_options","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2026-76219","published":"2026-08-19T14:02:03.425Z","updated":"2026-10-08T15:25:01.192Z","title":"GitPython before 3.1.58 Arbitrary File Overwrite via read-tree","severity":"HIGH","score":7.2,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00543,"kevAdded":null},{"id":"CVE-2026-76218","published":"2026-08-19T14:02:02.729Z","updated":"2026-10-08T15:25:00.661Z","title":"GitPython before 3.1.58 Remote Code Execution via Repo.init","severity":"HIGH","score":7.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.0072,"kevAdded":null},{"id":"CVE-2026-76217","published":"2026-08-19T14:02:02.061Z","updated":"2026-10-08T15:25:00.070Z","title":"GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file","severity":"HIGH","score":7.1,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-73625","published":"2026-08-13T11:28:24.833Z","updated":"2026-10-08T15:24:45.864Z","title":"GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00676,"kevAdded":null},{"id":"CVE-2026-73624","published":"2026-08-13T11:28:24.155Z","updated":"2026-10-08T15:24:44.790Z","title":"GitPython before 3.1.54 Arbitrary File Overwrite via diff","severity":"HIGH","score":7.2,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-73623","published":"2026-08-13T11:28:23.477Z","updated":"2026-10-08T15:24:44.174Z","title":"GitPython before 3.1.54 Remote Code Execution via --template","severity":"HIGH","score":7.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00961,"kevAdded":null},{"id":"CVE-2026-73622","published":"2026-08-13T11:28:22.807Z","updated":"2026-10-08T15:24:42.969Z","title":"GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-73621","published":"2026-08-13T11:28:22.108Z","updated":"2026-10-08T15:24:41.812Z","title":"GitPython before 3.1.56 Arbitrary File Truncation via Commit.count","severity":"MEDIUM","score":5.3,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-73620","published":"2026-08-13T11:28:21.426Z","updated":"2026-10-08T15:24:41.248Z","title":"GitPython before 3.1.57 Arbitrary File Overwrite and Read","severity":"HIGH","score":7.2,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2026-73619","published":"2026-08-13T11:28:20.737Z","updated":"2026-10-08T15:24:40.735Z","title":"GitPython before 3.1.57 Arbitrary File Read via Repo.archive()","severity":"HIGH","score":7.1,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-69097","published":"2026-08-03T13:20:49.256Z","updated":"2026-08-14T16:51:15.177Z","title":"GitPython before 3.1.53 Config Injection via Submodule Names","severity":"HIGH","score":7.3,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2026-67326","published":"2026-08-01T12:22:18.180Z","updated":"2026-08-14T16:50:54.075Z","title":"GitPython before 3.1.50 Newline Injection via config_writer section","severity":"HIGH","score":7.3,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-67324","published":"2026-08-01T12:22:18.154Z","updated":"2026-10-08T15:24:05.735Z","title":"GitPython 3.1.50 Authentication Bypass via Joined Short Options","severity":"CRITICAL","score":9.3,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2026-67323","published":"2026-08-01T12:22:18.119Z","updated":"2026-10-08T15:24:05.094Z","title":"GitPython before 3.1.51 Command Injection via unguarded Git options","severity":"HIGH","score":8.6,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.01251,"kevAdded":null},{"id":"CVE-2026-67322","published":"2026-08-01T12:22:17.009Z","updated":"2026-08-14T16:50:51.427Z","title":"GitPython before 3.1.52 Environment Variable Exfiltration via clone_from","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-67325","published":"2026-08-01T12:22:16.817Z","updated":"2026-10-08T15:24:06.398Z","title":"GitPython before 3.1.51 Command Injection via option prefix abbreviation","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.02209,"kevAdded":null},{"id":"CVE-2026-44243","published":"2026-05-07T18:22:53.622Z","updated":"2026-05-07T19:12:49.856Z","title":"GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository","severity":"HIGH","score":7.8,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-44244","published":"2026-05-07T18:22:39.704Z","updated":"2026-05-09T03:56:04.115Z","title":"GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath","severity":"HIGH","score":7.8,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-42284","published":"2026-05-07T18:19:20.129Z","updated":"2026-05-09T03:56:02.927Z","title":"GitPython: Unsafe option check validates multi_options before shlex.split transforms it","severity":"HIGH","score":8.1,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00571,"kevAdded":null},{"id":"CVE-2026-42215","published":"2026-05-07T18:17:03.194Z","updated":"2026-05-09T03:56:00.861Z","title":"GitPython: Command injection via Git options bypass","severity":"HIGH","score":8.8,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00749,"kevAdded":null},{"id":"CVE-2024-22190","published":"2024-01-11T01:23:17.944Z","updated":"2024-09-03T18:23:46.612Z","title":"Untrusted search path under some conditions on Windows allows arbitrary code execution","severity":"HIGH","score":7.8,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2023-41040","published":"2023-08-30T21:07:42.263Z","updated":"2025-11-03T21:49:29.315Z","title":"GitPython blind local file inclusion","severity":"MEDIUM","score":4,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.01093,"kevAdded":null},{"id":"CVE-2023-40590","published":"2023-08-28T17:24:09.965Z","updated":"2024-10-02T14:04:39.463Z","title":"Untrusted search path on Windows systems leading to arbitrary code execution","severity":"HIGH","score":7.8,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00509,"kevAdded":null}]}