Vendor
GitPython vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 26 vulnerabilities in GitPython: 0 in the last 7 days and 11 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-110859, was published on 14 October 2026. 3 vulnerabilities in the last four weeks, up 200% on the four before (1). 1 technology has a page of its own.
- Last 7 days
- 0
- Last 90 days
- 11
- Critical, all time
- 2
- Exploited in the wild
- 0
About GitPython
Python library for programmatic interaction with Git repositories.
GitPython technologies
Latest GitPython vulnerabilities
- CVE-2026-110859: GitPython argument injection in Head.checkout()highCVSS 7.5EPSS 0.4%
- CVE-2026-110858: GitPython remote code execution in Remote.pull() refspec argumenthighCVSS 8.1EPSS 0.5%
- CVE-2026-110855: GitPython environment variable expansion in submodule handlingmediumCVSS 6.5EPSS 0.3%
- CVE-2026-100689: GitPython path traversal in .gitmodules submodule updatemediumCVSS 5.9EPSS 0.4%
- GitPython incomplete denylist argument injection in Repo.blame()mediumCVSS 6.5
- GitPython local file disclosure via .gitmodules include directivehighCVSS 8.4
- GitPython path traversal in clone_from() and clone() via --separate-git-dirhighCVSS 7.5
- CVE-2026-78679: GitPython TagReference.create argument injection bypasses file-read guardmediumCVSS 6.5EPSS 0.3%
- CVE-2026-78678: GitPython arbitrary file read in Repo.blame via incomplete option denylistmediumCVSS 6.5EPSS 0.4%
- CVE-2026-78677: GitPython clone_from() omits --separate-git-dir from denylisthighCVSS 7.5EPSS 0.7%
- GitPython Repo.init argument injection via --templatehighCVSS 7.5
- CVE-2026-73625: GitPython remote code execution in option guard bypasshighCVSS 8.8EPSS 0.9%
- CVE-2026-73624: GitPython arbitrary file overwrite in Diffable.diffhighCVSS 8.1EPSS 0.5%
- CVE-2026-73623: GitPython unsafe_git_clone_options incomplete denylist in --templatehighCVSS 7.5EPSS 0.8%
- CVE-2026-73622: GitPython environment variable expansion in Remote.create() and Submodule.add()highCVSS 7.5EPSS 0.5%
- CVE-2026-73621: GitPython argument injection in Commit.countmediumCVSS 5.4EPSS 0.4%
- CVE-2026-73620: GitPython unguarded git option forwarding in IndexFile.checkout() and TagReference.create()highCVSS 8.1EPSS 0.6%
- CVE-2026-73619: GitPython incomplete denylist in Repo.archive allows arbitrary file readmediumCVSS 6.5EPSS 0.4%
- GitPython unsafe clone option gate bypass through joined short optionscriticalCVSS 9.8
- GitPython command injection via unguarded Git options in archive and ls_remotehighCVSS 8.4
- GitPython environment-variable exfiltration in Repo.clone_from()highCVSS 7.5
- CVE-2026-67326: GitPython newline injection in config_writer() section parameterhighCVSS 7EPSS 0.3%
- CVE-2026-67324: GitPython unsafe option gate bypass through joined short optionscriticalCVSS 9.8EPSS 0.6%
- CVE-2026-67323: GitPython command injection via unguarded Git optionshighCVSS 8.4EPSS 1.3%
- CVE-2026-67322: GitPython environment-variable exfiltration in Repo.clone_from()highCVSS 7.5EPSS 0.3%
Most severe GitPython vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-67324: GitPython unsafe option gate bypass through joined short optionscriticalCVSS 9.8EPSS 0.6%
- GitPython unsafe clone option gate bypass through joined short optionscriticalCVSS 9.8
- CVE-2026-73625: GitPython remote code execution in option guard bypasshighCVSS 8.8EPSS 0.9%
- CVE-2026-67323: GitPython command injection via unguarded Git optionshighCVSS 8.4EPSS 1.3%
- GitPython local file disclosure via .gitmodules include directivehighCVSS 8.4
- GitPython command injection via unguarded Git options in archive and ls_remotehighCVSS 8.4
- CVE-2026-73620: GitPython unguarded git option forwarding in IndexFile.checkout() and TagReference.create()highCVSS 8.1EPSS 0.6%
- CVE-2026-73624: GitPython arbitrary file overwrite in Diffable.diffhighCVSS 8.1EPSS 0.5%
- CVE-2026-110858: GitPython remote code execution in Remote.pull() refspec argumenthighCVSS 8.1EPSS 0.5%
- CVE-2026-73623: GitPython unsafe_git_clone_options incomplete denylist in --templatehighCVSS 7.5EPSS 0.8%
Vulnerabilities per week
3 vulnerabilities in the last four weeks, up 200% on the four before (1). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 1 | 0 | |
| 24 Aug 2026 | 6 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 1 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 3 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many GitPython vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/gitpython)<a href="https://junglewise.ai/threats/vendors/gitpython"><img src="https://junglewise.ai/threats/vendors/gitpython/badge.svg" alt="GitPython vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/gitpython.json, and this page as text at https://junglewise.ai/threats/vendors/gitpython.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "GitPython vulnerabilities", https://junglewise.ai/threats/vendors/gitpython, 12 November 2026.