Vulnerabilities for GitPython

First version without a known vulnerability: 3.1.58

Details

• GHSA-wvpp-8hx9-p66j2026-08-07

  GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

  Fixed in: 3.1.58

• GHSA-jm78-9fvv-mhgr2026-08-07

  GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

  Fixed in: 3.1.58

• GHSA-hmq2-w58f-27jc2026-08-07

  GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

  Fixed in: 3.1.58

• GHSA-hh9p-6wh2-4mfc2026-08-07

  GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

  Fixed in: 3.1.58

• GHSA-9rj7-rf2p-w77r2026-08-07

  GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

  Fixed in: 3.1.58

• GHSA-4gmw-gg2m-w46p2026-08-07

  GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

  Fixed in: 3.1.58

• GHSA-p538-c434-8v242026-08-03

  GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count

  Fixed in: 3.1.56

• GHSA-539m-9xh6-q6rr2026-08-03

  GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()

  Fixed in: 3.1.57

• GHSA-3f7w-8rr8-f37f2026-08-03

  GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

  Fixed in: 3.1.57

• GHSA-94p4-4cq8-9g672026-07-24

  GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

  Fixed in: 3.1.55

• GHSA-r9mr-m37c-5fr32026-07-24

  GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

  Fixed in: 3.1.54

• GHSA-6p8h-3wgx-97gf2026-07-24

  GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

  Fixed in: 3.1.54

• GHSA-fjr4-x663-mwxc2026-07-24

  GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

  Fixed in: 3.1.54

• GHSA-3rp5-jjmw-4wv22026-07-24

  GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

  Fixed in: 3.1.53

• GHSA-rwj8-pgh3-r5732026-07-21

  GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

  Fixed in: 3.1.52

• GHSA-956x-8gvw-wg5v2026-07-21

  GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

  Fixed in: 3.1.51

• GHSA-2f96-g7mh-g2hx2026-07-21

  GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

  Fixed in: 3.1.51

• GHSA-v396-v7q4-x2qj2026-07-21

  GitPython unsafe clone option gate bypass through joined short options

  Fixed in: 3.1.51

• GHSA-mv93-w799-cj2w2026-05-08

  GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

  Fixed in: 3.1.50

• GHSA-v87r-6q3f-2j672026-05-06

  GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

  Fixed in: 3.1.49

• GHSA-7545-fcxq-7j242026-05-06

  GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

  Fixed in: 3.1.48

• GHSA-rpm5-65cw-6hj42026-04-25

  GitPython has Command Injection via Git options bypass

  Fixed in: 3.1.47

• GHSA-x2qx-6953-84852026-04-25

  GitPython: Unsafe option check validates multi_options before shlex.split transformation

  Fixed in: 3.1.47

• GHSA-2mqj-m65w-jghx2024-01-10

  Untrusted search path under some conditions on Windows allows arbitrary code execution

  Fixed in: 3.1.41, ef3192cc414f2fd9978908454f6fd95243784c7f

• GHSA-cwvm-v4w8-q58c2023-08-30

  GitPython blind local file inclusion

  Fixed in: 3.1.37, 3.1.35

• GHSA-wfm5-v35h-vwf42023-08-29

  GitPython untrusted search path on Windows systems leading to arbitrary code execution

  Fixed in: 3.1.33

• GHSA-pr76-5cm5-w9cj2023-08-11

  GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

  Fixed in: 3.1.32, ca965ecc81853bca7675261729143f54e5bf4cdd

• GHSA-hcpj-qp55-gfph2022-12-06

  GitPython vulnerable to Remote Code Execution due to improper user input validation

  Fixed in: 3.1.30