SB2026082660 - Multiple vulnerabilities in GitPython
Published: August 26, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Insecure DLL loading (CVE-ID: N/A)
CWE-ID: CWE-427 - Uncontrolled Search Path Element
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to uncontrolled search path resolution in Repo.__init__ and commit hook path handling when opening or cloning a crafted repository and performing index.commit(). A remote attacker can place crafted repository-root files and a malicious hooks/pre-commit script to execute arbitrary code.
User interaction is required to open or clone the crafted repository.
2) Insecure DLL loading (CVE-ID: N/A)
CWE-ID: CWE-427 - Uncontrolled Search Path Element
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in Repo._config_reader and git directory resolution when opening a crafted repository and reading repository configuration. A remote attacker can provide a crafted config with include directives to disclose sensitive information.
User interaction is required to open or clone the crafted repository.
3) Insecure DLL loading (CVE-ID: N/A)
CWE-ID: CWE-427 - Uncontrolled Search Path Element
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to overwrite files in an attacker-chosen directory.
The vulnerability exists due to improper path resolution in commondir handling when processing a crafted repository layout. A remote attacker can provide an absolute tracked commondir value to overwrite files in an attacker-chosen directory.
User interaction is required to open or clone the crafted repository.
4) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: N/A)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper neutralization of argument delimiters in the high-level diff API when processing attacker-influenced diff options and path operands with --no-index and --ignore-matching-lines. A remote user can send crafted diff options and filesystem path operands to disclose sensitive information.
Exploitation requires an embedding application to expose a distinguishable success or error result and to allow repeated requests.
5) Inefficient regular expression complexity (CVE-ID: N/A)
CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in Actor.name_email_regex in git/util.py when parsing the author or committer header of a git commit object containing a long string with an unterminated < character. A remote attacker can supply a specially crafted commit object to cause a denial of service.
The issue is triggered when GitPython resolves commit metadata such as .author or .committer from repositories or commit objects obtained from untrusted sources.
Remediation
Install update from vendor's website.