SB2026080540 - Multiple vulnerabilities in GitPython

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080540

SB2026080540 - Multiple vulnerabilities in GitPython

Published: August 5, 2026

Security Bulletin ID SB2026080540
CSH Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 17% Medium 50% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in IndexFile.remove() and Head.checkout() when forwarding user-supplied keyword arguments to git rm and git checkout. A remote user can supply a crafted pathspec_from_file value together with pathspec_file_nul to disclose sensitive information.

The targeted file must be readable by the process, and disclosure occurs in the returned GitCommandError stderr when the supplied pathspec does not match a tracked path.


2) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: N/A)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of argument delimiters in Repo.init when forwarding user-supplied git options to git init. A remote user can supply a crafted template option to plant a hook that executes on the next git operation to execute arbitrary code.

Exploitation requires the application to pass an attacker-controlled template argument and for an executable hook directory to be staged at a known path.


3) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: N/A)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to overwrite arbitrary files.

The vulnerability exists due to improper neutralization of argument delimiters in a command in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree when appending caller-influenced treeish arguments to git read-tree. A remote user can supply a specially crafted treeish value to overwrite arbitrary files.

The overwritten content is constrained to a valid git index blob rather than attacker-chosen file contents.


4) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: N/A)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary commands.

The vulnerability exists due to improper neutralization of argument delimiters in a command in the unsafe option guard for git kwargs handling when processing user-controlled keyword arguments with split_single_char_options disabled. A remote user can supply a crafted single-character option value that is transformed into a joined short-option token to execute arbitrary commands.

Exploitation requires an application to forward a user-controlled kwargs dictionary to a guarded GitPython method such as clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive.


5) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: N/A)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in the GitPython config writer when writing attacker-controlled option names into git configuration files. A remote user can supply a crafted option name to forge git configuration directives and execute arbitrary code.

Exploitation requires an embedding application to pass a caller-influenced option name to the configuration writer, and code execution occurs on a subsequent git operation such as an ssh git action or hook execution.


6) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to create arbitrary Git repositories outside the working tree.

The vulnerability exists due to path traversal in submodule initialization logic when processing a cloned repository's .gitmodules submodule name during submodule initialization. A remote attacker can supply a specially crafted repository with a traversal string in the submodule name to create arbitrary Git repositories outside the working tree.

User interaction is required to clone the malicious repository and run submodule initialization.


Remediation

Install update from vendor's website.

References