Gitpython-developers
Gitpython-developers Security Releases - October 2026
gitpython-developers-2026-10 Oct 1, 2026 Source: Vendor
Gitpython-developers security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-110855
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
6 lines
Showing 1–6 of 6 matching , clear filters
CVE-2026-110856
BR2026-0000-031420
GitPython
unclaimed
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers ca...
Credited as BrianWillows
CVE-2026-110857
BR2026-0000-031421
GitPython
unclaimed
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers ...
Credited as wirsbf
CVE-2026-110858
BR2026-0000-031422
GitPython
unclaimed
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers c...
Credited as manus-pi
CVE-2026-110858
BR2026-0000-031423
GitPython
unclaimed
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers c...
Credited as manus-use
CVE-2026-110859
BR2026-0000-031424
GitPython
unclaimed
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attack...
Credited as 0xMax-Sec
CVE-2026-110860
BR2026-0000-031425
GitPython
unclaimed
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path compone...
Credited as dpfkdlemtp