CVE Tools
Track your stack

Gitpython

71 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Gitpython, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Gitpython CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Gitpython CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-055
2026-060
2026-079
2026-0833
2026-096
2026-1013
2026-110

Severity

How the 71 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical37%
  • High3170%
  • Medium1023%

Latest CVEs

The 15 most recently published vulnerabilities affecting Gitpython.

  1. GHSA-23mf-xhv8-69c2GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)—
  2. GHSA-gq48-pqfc-9p58GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree—
  3. GHSA-f9j4-qggq-h239GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution—
  4. GHSA-w8jc-g24h-crhwGitPython command wrappers omit unsafe protocol and option checks—
  5. GHSA-fx3j-rwgx-fr94GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name—
  6. GHSA-m64x-33q8-m5h7GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines—
  7. CVE-2026-114145GitPython validates a submodule's ".git" path only after cloning into it (RCE)7.5
  8. CVE-2026-110860GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()6.1
  9. CVE-2026-110859GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name7.5
  10. CVE-2026-110858GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec8.1
  11. CVE-2026-110857GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs7.5
  12. CVE-2026-110856GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date7.5
  13. CVE-2026-110855GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name6.5
  14. GHSA-59cr-6r3x-644wGitPython submodule update path traversal can write outside the repository—
  15. GHSA-whh4-5q6c-9v3xGitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle—

Product grouping is registry-driven, with AI assist and human review. How it works