gitpython 3.1.52: known vulnerabilities · Page 2

Could not compare 2 records. The results are incomplete.

1. CVE-2026-73620

   High · CVSS 7.2EPSS 0.57%Fix available

   GitPython before 3.1.57 Arbitrary File Overwrite and Read

   GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.

   gitpythonPython

   • Update to 3.1.57

   Published August 13, 2026Updated October 8, 2026

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

2. CVE-2026-73619

   High · CVSS 7.1EPSS 0.41%Fix available

   GitPython before 3.1.57 Arbitrary File Read via Repo.archive()

   GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.

   gitpythonPython

   • Update to 3.1.57

   Published August 13, 2026Updated October 8, 2026

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

3. CVE-2026-69097

   High · CVSS 7.3EPSS 0.27%Fix available

   GitPython before 3.1.53 Config Injection via Submodule Names

   GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

   gitpythonPython

   • Update to 3.1.53

   Published August 3, 2026Updated August 14, 2026

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗