Gitpython-Developers · product
GitPython
42 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 42 is a mark on the map. Named now: 1 to 26, most at risk first.
- GitPython before 3.1.51 Command Injection via option prefix abbreviation
- GitPython before 3.1.51 Command Injection via unguarded Git options
- GitPython blind local file inclusion
- GitPython before 3.1.54 Remote Code Execution via --template
- GitPython: Command injection via Git options bypass
- GitPython before 3.1.58 Remote Code Execution via Repo.init
- GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling
- GitPython before 3.1.59 Path Traversal via separate-git-dir
- GitPython before 3.1.58 Command Execution via split_single_char_options
- GitPython before 3.1.57 Arbitrary File Overwrite and Read
- GitPython: Unsafe option check validates multi_options before shlex.split transforms it
- GitPython before 3.1.59 Remote Code Execution via Config Injection
- GitPython before 3.1.54 Arbitrary File Overwrite via diff
- GitPython before 3.1.58 Arbitrary File Overwrite via read-tree
- GitPython before 3.1.60 Denial of Service via ReDoS
- GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()
- Untrusted search path on Windows systems leading to arbitrary code execution
- GitPython before 3.1.58 Config Injection via option-name
- GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
- GitPython 3.1.50 Authentication Bypass via Joined Short Options
- GitPython validates a submodule's ".git" path only after cloning into it (RCE)
- GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name
- GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
- GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository
- GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs
- GitPython 3.1.59 Local File Content Oracle via --no-index
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.