GitPython vulnerabilities
CVEs whose affected-version data names the GitPython package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
66 CVEsRSS
GHSA-956x-8gvw-wg5vHigh· 8.4GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
GHSA-v396-v7q4-x2qjHighGitPython unsafe clone option gate bypass through joined short options
GitPython unsafe clone option gate bypass through joined short options
GHSA-2f96-g7mh-g2hxHigh· 8.8GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
CVE-2026-44243High· 7.1GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
CVE-2024-22190High· 7.8Untrusted search path under some conditions on Windows allows arbitrary code execution
Untrusted search path under some conditions on Windows allows arbitrary code execution
CVE-2023-40590High· 7.8GitPython untrusted search path on Windows systems leading to arbitrary code execution
GitPython untrusted search path on Windows systems leading to arbitrary code execution