{"schema_version":1,"title":"Gitpython Project vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 24 vulnerabilities in Gitpython Project: 0 in the last 7 days and 22 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-87819, was published on 9 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/gitpython-project","json_url":"https://junglewise.ai/threats/vendors/gitpython-project.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/gitpython-project","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":17,"all_time":24,"critical":3,"exploited":0,"last_7_days":0,"last_30_days":3,"last_90_days":22,"last_365_days":24},"latest":[{"cve":"CVE-2026-87819","cvss":7.5,"epss":0.0052,"slug":"cve-2026-87819-gitpython-redos-via-catastrophic-backtracking-in-actor-name-email","title":"GitPython ReDoS via catastrophic backtracking in Actor.name_email_regex","severity":"high","exploited":false,"published_at":"2026-09-09T12:17:17.12+00:00","url":"https://junglewise.ai/threats/cve-2026-87819-gitpython-redos-via-catastrophic-backtracking-in-actor-name-email"},{"cve":"CVE-2026-87818","cvss":6.5,"epss":0.0041,"slug":"cve-2026-87818-gitpython-argument-injection-in-diff-api-via-no-index","title":"GitPython argument injection in diff API via --no-index","severity":"medium","exploited":false,"published_at":"2026-09-09T12:17:16.98+00:00","url":"https://junglewise.ai/threats/cve-2026-87818-gitpython-argument-injection-in-diff-api-via-no-index"},{"cve":"CVE-2026-87817","cvss":8.8,"epss":0.0041,"slug":"cve-2026-87817-gitpython-git-directory-impersonation-leading-to-code-execution","title":"GitPython git directory impersonation leading to code execution","severity":"high","exploited":false,"published_at":"2026-09-09T12:17:16.83+00:00","url":"https://junglewise.ai/threats/cve-2026-87817-gitpython-git-directory-impersonation-leading-to-code-execution"},{"cvss":7.5,"slug":"gitpython-path-traversal-in-clone-from-and-clone-via-separate-git-dir-76bb0c2e","title":"GitPython path traversal in clone_from() and clone() via --separate-git-dir","severity":"high","exploited":false,"published_at":"2026-08-25T03:32:10+00:00","url":"https://junglewise.ai/threats/gitpython-path-traversal-in-clone-from-and-clone-via-separate-git-dir-76bb0c2e"},{"cve":"CVE-2026-78678","cvss":6.5,"epss":0.0041,"slug":"cve-2026-78678-gitpython-arbitrary-file-read-in-repo-blame-via-incomplete-option","title":"GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S option","severity":"medium","exploited":false,"published_at":"2026-08-25T02:16:52.313+00:00","url":"https://junglewise.ai/threats/cve-2026-78678-gitpython-arbitrary-file-read-in-repo-blame-via-incomplete-option"},{"cve":"CVE-2026-78677","cvss":7.5,"epss":0.0065,"slug":"cve-2026-78677-gitpython-clone-from-omits-separate-git-dir-from-denylist","title":"GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outsi","severity":"high","exploited":false,"published_at":"2026-08-25T02:16:52.173+00:00","url":"https://junglewise.ai/threats/cve-2026-78677-gitpython-clone-from-omits-separate-git-dir-from-denylist"},{"cve":"CVE-2026-78676","cvss":9.8,"epss":0.0078,"slug":"cve-2026-78676-gitpython-config-parser-multi-line-value-injection-in-write","title":"GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values","severity":"critical","exploited":false,"published_at":"2026-08-25T02:16:52.03+00:00","url":"https://junglewise.ai/threats/cve-2026-78676-gitpython-config-parser-multi-line-value-injection-in-write"},{"cve":"CVE-2026-78675","cvss":8.4,"epss":0.0018,"slug":"cve-2026-78675-gitpython-arbitrary-local-file-content-disclosure-via-gitmodules","title":"GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by inclu","severity":"high","exploited":false,"published_at":"2026-08-25T02:16:51.887+00:00","url":"https://junglewise.ai/threats/cve-2026-78675-gitpython-arbitrary-local-file-content-disclosure-via-gitmodules"},{"cvss":7.5,"slug":"gitpython-repo-init-argument-injection-via-template-8149779a","title":"GitPython Repo.init argument injection via --template","severity":"high","exploited":false,"published_at":"2026-08-19T15:32:33+00:00","url":"https://junglewise.ai/threats/gitpython-repo-init-argument-injection-via-template-8149779a"},{"cve":"CVE-2026-73625","cvss":8.8,"epss":0.0092,"slug":"cve-2026-73625-gitpython-remote-code-execution-in-option-guard-bypass","title":"GitPython remote code execution in option guard bypass","severity":"high","exploited":false,"published_at":"2026-08-13T12:17:27.753+00:00","url":"https://junglewise.ai/threats/cve-2026-73625-gitpython-remote-code-execution-in-option-guard-bypass"},{"cve":"CVE-2026-73623","cvss":7.5,"epss":0.0084,"slug":"cve-2026-73623-gitpython-unsafe-git-clone-options-incomplete-denylist-in","title":"GitPython unsafe_git_clone_options incomplete denylist in --template","severity":"high","exploited":false,"published_at":"2026-08-13T12:17:27.477+00:00","url":"https://junglewise.ai/threats/cve-2026-73623-gitpython-unsafe-git-clone-options-incomplete-denylist-in"},{"cve":"CVE-2026-73622","cvss":7.5,"epss":0.0051,"slug":"cve-2026-73622-gitpython-environment-variable-expansion-in-remote-create-and","title":"GitPython environment variable expansion in Remote.create() and Submodule.add()","severity":"high","exploited":false,"published_at":"2026-08-13T12:17:27.337+00:00","url":"https://junglewise.ai/threats/cve-2026-73622-gitpython-environment-variable-expansion-in-remote-create-and"},{"cve":"CVE-2026-73621","cvss":5.4,"epss":0.0036,"slug":"cve-2026-73621-gitpython-argument-injection-in-commit-count","title":"GitPython argument injection in Commit.count","severity":"medium","exploited":false,"published_at":"2026-08-13T12:17:27.2+00:00","url":"https://junglewise.ai/threats/cve-2026-73621-gitpython-argument-injection-in-commit-count"},{"cve":"CVE-2026-73620","cvss":8.1,"epss":0.0057,"slug":"cve-2026-73620-gitpython-unguarded-git-option-forwarding-in-indexfile-checkout","title":"GitPython unguarded git option forwarding in IndexFile.checkout() and TagReference.create()","severity":"high","exploited":false,"published_at":"2026-08-13T12:17:27.057+00:00","url":"https://junglewise.ai/threats/cve-2026-73620-gitpython-unguarded-git-option-forwarding-in-indexfile-checkout"},{"cve":"CVE-2026-73619","cvss":6.5,"epss":0.0041,"slug":"cve-2026-73619-gitpython-incomplete-denylist-in-repo-archive-allows-arbitrary","title":"GitPython incomplete denylist in Repo.archive allows arbitrary file read","severity":"medium","exploited":false,"published_at":"2026-08-13T12:17:26.913+00:00","url":"https://junglewise.ai/threats/cve-2026-73619-gitpython-incomplete-denylist-in-repo-archive-allows-arbitrary"},{"cvss":8.4,"slug":"gitpython-command-injection-via-unguarded-git-options-in-archive-and-ls-d903ac45","title":"GitPython command injection via unguarded Git options in archive and ls_remote","severity":"high","exploited":false,"published_at":"2026-08-01T15:30:28+00:00","url":"https://junglewise.ai/threats/gitpython-command-injection-via-unguarded-git-options-in-archive-and-ls-d903ac45"},{"cvss":9.8,"slug":"gitpython-unsafe-clone-option-gate-bypass-through-joined-short-options-627f633b","title":"GitPython unsafe clone option gate bypass through joined short options","severity":"critical","exploited":false,"published_at":"2026-08-01T15:30:28+00:00","url":"https://junglewise.ai/threats/gitpython-unsafe-clone-option-gate-bypass-through-joined-short-options-627f633b"},{"cve":"CVE-2026-67326","cvss":7,"epss":0.0025,"slug":"cve-2026-67326-gitpython-newline-injection-in-config-writer-section-parameter","title":"GitPython newline injection in config_writer() section parameter","severity":"high","exploited":false,"published_at":"2026-08-01T13:17:03.063+00:00","url":"https://junglewise.ai/threats/cve-2026-67326-gitpython-newline-injection-in-config-writer-section-parameter"},{"cve":"CVE-2026-67325","cvss":8.8,"epss":0.0221,"slug":"cve-2026-67325-gitpython-command-injection-via-option-prefix-abbreviation","title":"GitPython command injection via option prefix abbreviation","severity":"high","exploited":false,"published_at":"2026-08-01T13:17:02.923+00:00","url":"https://junglewise.ai/threats/cve-2026-67325-gitpython-command-injection-via-option-prefix-abbreviation"},{"cve":"CVE-2026-67324","cvss":9.8,"epss":0.0064,"slug":"cve-2026-67324-gitpython-unsafe-option-gate-bypass-through-joined-short-options","title":"GitPython unsafe option gate bypass through joined short options","severity":"critical","exploited":false,"published_at":"2026-08-01T13:17:02.77+00:00","url":"https://junglewise.ai/threats/cve-2026-67324-gitpython-unsafe-option-gate-bypass-through-joined-short-options"},{"cve":"CVE-2026-67323","cvss":8.4,"epss":0.0125,"slug":"cve-2026-67323-gitpython-command-injection-via-unguarded-git-options","title":"GitPython command injection via unguarded Git options","severity":"high","exploited":false,"published_at":"2026-08-01T13:17:02.637+00:00","url":"https://junglewise.ai/threats/cve-2026-67323-gitpython-command-injection-via-unguarded-git-options"},{"cve":"CVE-2026-67322","cvss":7.5,"epss":0.0033,"slug":"cve-2026-67322-gitpython-environment-variable-exfiltration-in-repo-clone-from","title":"GitPython environment-variable exfiltration in Repo.clone_from()","severity":"high","exploited":false,"published_at":"2026-08-01T13:17:02.493+00:00","url":"https://junglewise.ai/threats/cve-2026-67322-gitpython-environment-variable-exfiltration-in-repo-clone-from"},{"cve":"CVE-2026-44244","cvss":7.8,"epss":0.0022,"slug":"cve-2026-44244-gitpython-newline-injection-in-gitconfigparser-set-value","title":"GitPython newline injection in GitConfigParser.set_value","severity":"high","exploited":false,"published_at":"2026-05-07T19:16:02.357+00:00","url":"https://junglewise.ai/threats/cve-2026-44244-gitpython-newline-injection-in-gitconfigparser-set-value"},{"cve":"CVE-2026-42215","cvss":8.8,"epss":0.009,"slug":"cve-2026-42215-gitpython-command-injection-via-keyword-argument-bypass","title":"GitPython command injection via keyword argument bypass","severity":"high","exploited":false,"published_at":"2026-05-07T19:16:01.64+00:00","url":"https://junglewise.ai/threats/cve-2026-42215-gitpython-command-injection-via-keyword-argument-bypass"}],"vendor":{"hub":true,"name":"Gitpython Project","slug":"gitpython-project","homepage":"https://gitpython.readthedocs.io/","description":"The GitPython project maintains a Python library used to interact with Git repositories.","url":"https://junglewise.ai/threats/vendors/gitpython-project"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":2,"exploited":0,"vulnerabilities":7},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-24","critical":1,"exploited":0,"vulnerabilities":5},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-78676","cvss":9.8,"epss":0.0078,"slug":"cve-2026-78676-gitpython-config-parser-multi-line-value-injection-in-write","title":"GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values","severity":"critical","exploited":false,"published_at":"2026-08-25T02:16:52.03+00:00","url":"https://junglewise.ai/threats/cve-2026-78676-gitpython-config-parser-multi-line-value-injection-in-write"},{"cve":"CVE-2026-67324","cvss":9.8,"epss":0.0064,"slug":"cve-2026-67324-gitpython-unsafe-option-gate-bypass-through-joined-short-options","title":"GitPython unsafe option gate bypass through joined short options","severity":"critical","exploited":false,"published_at":"2026-08-01T13:17:02.77+00:00","url":"https://junglewise.ai/threats/cve-2026-67324-gitpython-unsafe-option-gate-bypass-through-joined-short-options"},{"cvss":9.8,"slug":"gitpython-unsafe-clone-option-gate-bypass-through-joined-short-options-627f633b","title":"GitPython unsafe clone option gate bypass through joined short options","severity":"critical","exploited":false,"published_at":"2026-08-01T15:30:28+00:00","url":"https://junglewise.ai/threats/gitpython-unsafe-clone-option-gate-bypass-through-joined-short-options-627f633b"},{"cve":"CVE-2026-67325","cvss":8.8,"epss":0.0221,"slug":"cve-2026-67325-gitpython-command-injection-via-option-prefix-abbreviation","title":"GitPython command injection via option prefix abbreviation","severity":"high","exploited":false,"published_at":"2026-08-01T13:17:02.923+00:00","url":"https://junglewise.ai/threats/cve-2026-67325-gitpython-command-injection-via-option-prefix-abbreviation"},{"cve":"CVE-2026-73625","cvss":8.8,"epss":0.0092,"slug":"cve-2026-73625-gitpython-remote-code-execution-in-option-guard-bypass","title":"GitPython remote code execution in option guard bypass","severity":"high","exploited":false,"published_at":"2026-08-13T12:17:27.753+00:00","url":"https://junglewise.ai/threats/cve-2026-73625-gitpython-remote-code-execution-in-option-guard-bypass"},{"cve":"CVE-2026-42215","cvss":8.8,"epss":0.009,"slug":"cve-2026-42215-gitpython-command-injection-via-keyword-argument-bypass","title":"GitPython command injection via keyword argument bypass","severity":"high","exploited":false,"published_at":"2026-05-07T19:16:01.64+00:00","url":"https://junglewise.ai/threats/cve-2026-42215-gitpython-command-injection-via-keyword-argument-bypass"},{"cve":"CVE-2026-87817","cvss":8.8,"epss":0.0041,"slug":"cve-2026-87817-gitpython-git-directory-impersonation-leading-to-code-execution","title":"GitPython git directory impersonation leading to code execution","severity":"high","exploited":false,"published_at":"2026-09-09T12:17:16.83+00:00","url":"https://junglewise.ai/threats/cve-2026-87817-gitpython-git-directory-impersonation-leading-to-code-execution"},{"cve":"CVE-2026-67323","cvss":8.4,"epss":0.0125,"slug":"cve-2026-67323-gitpython-command-injection-via-unguarded-git-options","title":"GitPython command injection via unguarded Git options","severity":"high","exploited":false,"published_at":"2026-08-01T13:17:02.637+00:00","url":"https://junglewise.ai/threats/cve-2026-67323-gitpython-command-injection-via-unguarded-git-options"},{"cve":"CVE-2026-78675","cvss":8.4,"epss":0.0018,"slug":"cve-2026-78675-gitpython-arbitrary-local-file-content-disclosure-via-gitmodules","title":"GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by inclu","severity":"high","exploited":false,"published_at":"2026-08-25T02:16:51.887+00:00","url":"https://junglewise.ai/threats/cve-2026-78675-gitpython-arbitrary-local-file-content-disclosure-via-gitmodules"},{"cvss":8.4,"slug":"gitpython-command-injection-via-unguarded-git-options-in-archive-and-ls-d903ac45","title":"GitPython command injection via unguarded Git options in archive and ls_remote","severity":"high","exploited":false,"published_at":"2026-08-01T15:30:28+00:00","url":"https://junglewise.ai/threats/gitpython-command-injection-via-unguarded-git-options-in-archive-and-ls-d903ac45"}],"generated_at":"2026-09-26T11:07:00.153785+00:00","technologies":[{"name":"Gitpython Project Gitpython","slug":"gitpython","vulnerabilities":56,"url":"https://junglewise.ai/threats/technologies/gitpython"}]}