p PatchFirst

PatchFirst · Latest vulnerabilities

gitpython 3.1.53: known vulnerabilities · Page 2

The comparison for gitpython 3.1.53 is incomplete. Review the confirmed matches below.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Could not compare 2 records. The results are incomplete.

Vulnerabilities: 22

  1. CVE-2026-73620

    High · CVSS 7.2EPSS 0.57%Fix available

    GitPython before 3.1.57 Arbitrary File Overwrite and Read

    GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.

    gitpythonPython
    • Update to 3.1.57
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-73619

    High · CVSS 7.1EPSS 0.41%Fix available

    GitPython before 3.1.57 Arbitrary File Read via Repo.archive()

    GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.

    gitpythonPython
    • Update to 3.1.57
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →