SB2026102166 - SUSE update for python-GitPython
Published: October 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 27 vulnerabilities.
1) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-73623)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary commands.
The vulnerability exists due to an incomplete list of disallowed inputs in unsafe_git_clone_options in base.py when processing clone options. A remote user can supply the --template option pointing to a directory containing a crafted hook to execute arbitrary commands.
Exploitation requires an attacker-readable directory containing an executable hook, and the post-checkout hook is executed during clone.
2) Argument injection (CVE-ID: CVE-2026-78679)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper neutralization of argument delimiters in TagReference.create() when forwarding a caller-influenced positional reference value to git tag. A remote user can supply a reference value containing a --file option to disclose sensitive information.
Exploitation requires an embedding application to forward a caller-influenced reference value to TagReference.create().
3) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-78678)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper neutralization of argument delimiters in Repo.blame() and Repo.blame_incremental() when processing a caller-influenced revision value. A remote user can pass a specially crafted revision option such as --contents=<path> or -S <file> to disclose sensitive information.
The file contents are echoed into the blame result returned to the caller, and the issue occurs with the default allow_unsafe_options=false setting.
4) Path traversal (CVE-ID: CVE-2026-78677)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to create an arbitrary git directory outside the intended destination.
The vulnerability exists due to improper limitation of a pathname to a restricted directory in Repo.clone_from()/Repo.clone() option handling when forwarding a caller-controlled separate_git_dir argument to git clone. A remote attacker can supply a specially crafted separate_git_dir path to create an arbitrary git directory outside the intended destination.
Exploitation requires a host application to pass attacker-influenced clone options to the API without rejecting the separate_git_dir argument.
5) Code Injection (CVE-ID: CVE-2026-78676)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to code injection in GitConfigParser._write()/write_section() in git/config.py when re-serializing previously parsed multi-line git-config values during an unrelated config write. A remote attacker can supply a crafted config value that is rewritten into a live injected directive such as core.hooksPath to execute arbitrary code.
Exploitation requires an attacker-influenced config file to be opened read-write and later flushed through any legitimate write operation. The injected directive becomes active on a subsequent hook-firing git operation.
6) External Control of File Name or Path (CVE-ID: CVE-2026-78675)
CWE-ID: CWE-73 - External Control of File Name or Path
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information from arbitrary local files.
The vulnerability exists due to external control of file name or path in SubmoduleConfigParser and GitConfigParser when parsing an untrusted .gitmodules file containing an [include] directive. A remote attacker can supply a crafted repository whose .gitmodules references a readable local file to disclose sensitive information from arbitrary local files.
The disclosure occurs through an uncaught parsing exception that embeds the first line of the referenced file in the error message during submodule enumeration.
7) Path traversal (CVE-ID: CVE-2026-76222)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to create arbitrary Git repositories outside the working tree.
The vulnerability exists due to path traversal in submodule initialization logic when processing a cloned repository's .gitmodules submodule name during submodule initialization. A remote attacker can supply a specially crafted repository with a traversal string in the submodule name to create arbitrary Git repositories outside the working tree.
User interaction is required to clone the malicious repository and run submodule initialization.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in the GitPython config writer when writing attacker-controlled option names into git configuration files. A remote user can supply a crafted option name to forge git configuration directives and execute arbitrary code.
Exploitation requires an embedding application to pass a caller-influenced option name to the configuration writer, and code execution occurs on a subsequent git operation such as an ssh git action or hook execution.
9) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-76220)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary commands.
The vulnerability exists due to improper neutralization of argument delimiters in a command in the unsafe option guard for git kwargs handling when processing user-controlled keyword arguments with split_single_char_options disabled. A remote user can supply a crafted single-character option value that is transformed into a joined short-option token to execute arbitrary commands.
Exploitation requires an application to forward a user-controlled kwargs dictionary to a guarded GitPython method such as clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive.
10) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-76219)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite arbitrary files.
The vulnerability exists due to improper neutralization of argument delimiters in a command in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree when appending caller-influenced treeish arguments to git read-tree. A remote user can supply a specially crafted treeish value to overwrite arbitrary files.
The overwritten content is constrained to a valid git index blob rather than attacker-chosen file contents.
11) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-76218)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper neutralization of argument delimiters in Repo.init when forwarding user-supplied git options to git init. A remote user can supply a crafted template option to plant a hook that executes on the next git operation to execute arbitrary code.
Exploitation requires the application to pass an attacker-controlled template argument and for an executable hook directory to be staged at a known path.
12) Information disclosure (CVE-ID: CVE-2026-76217)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in IndexFile.remove() and Head.checkout() when forwarding user-supplied keyword arguments to git rm and git checkout. A remote user can supply a crafted pathspec_from_file value together with pathspec_file_nul to disclose sensitive information.
The targeted file must be readable by the process, and disclosure occurs in the returned GitCommandError stderr when the supplied pathspec does not match a tracked path.
13) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-73625)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary os commands.
The vulnerability exists due to improper neutralization of argument delimiters in a command in the check_unsafe_options guard and single-character kwarg transformation logic when processing user-supplied keyword arguments for guarded git methods. A remote user can supply a single-character kwarg value that is transformed into a separate unsafe git option token to execute arbitrary os commands.
In the default configuration, the issue affects guarded methods including clone, fetch, pull, push, ls_remote, iter_commits, blame, and archive.
14) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-73624)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite arbitrary files.
The vulnerability exists due to improper neutralization of argument delimiters in a command in Diffable.diff when forwarding user-controlled arguments to git diff or git diff-tree. A remote user can supply a crafted output argument or a crafted other value to overwrite arbitrary files.
The issue affects both key-controlled and value-controlled input paths because the caller-supplied other reference is inserted before the -- separator and can be parsed as a git option.
15) OS Command Injection (CVE-ID: CVE-2026-42215)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to command injection in Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() when processing attacker-controlled kwargs that are normalized into unsafe Git options. A remote user can supply crafted upload_pack or receive_pack values to execute arbitrary code.
The issue occurs because underscore-form kwargs bypass the unsafe-option check before being converted into dangerous command-line flags, and it does not require a malicious repository.
16) Information disclosure (CVE-ID: CVE-2026-73622)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in Repo.create_remote(), Remote.add(), and Submodule.add() when processing an attacker-controlled repository URL. A remote attacker can supply a URL containing environment-variable references to disclose sensitive information.
The supplied variable references are expanded server-side, stored in .git/config, and the resulting secret-bearing URL is transmitted on the next fetch, pull, or remote update. In the Submodule.add() path, the expanded URL is also written to .gitmodules.
17) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-73621)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to truncate an arbitrary file.
The vulnerability exists due to improper neutralization of argument delimiters in a command in Commit.count when forwarding user-supplied keyword arguments to git rev-list. A remote user can supply a crafted output argument to truncate an arbitrary file.
The file is truncated to 0 bytes at the privilege level of the running process.
18) External Control of File Name or Path (CVE-ID: CVE-2026-73620)
CWE-ID: CWE-73 - External Control of File Name or Path
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite arbitrary files.
The vulnerability exists due to external control of file name or path in IndexFile.checkout() when forwarding user-supplied git options to git checkout-index. A remote user can supply a crafted prefix option to overwrite arbitrary files.
The written content is taken from repository-controlled tracked files, and the overwrite can occur outside the working tree.
19) External Control of File Name or Path (CVE-ID: CVE-2026-73619)
CWE-ID: CWE-73 - External Control of File Name or Path
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to external control of file name or path in Repo.archive() when processing caller-influenced archive options. A remote user can supply a crafted --add-file option to disclose sensitive information.
Exploitation requires an application to forward caller-influenced keyword arguments into Repo.archive().
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements in git config section names in the GitPython config writer when writing attacker-controlled submodule names into the parent repository's .git/config. A remote attacker can supply a specially crafted submodule name to inject arbitrary config directives and execute arbitrary code.
User interaction is required for the victim to perform a subsequent git operation that uses the injected configuration, and the issue is reachable via untrusted .gitmodules data during submodule initialization or via applications that create submodules from untrusted input.
21) Input validation error (CVE-ID: CVE-2026-67326)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in config_writer() and set_value() in git/config.py when processing a crafted section parameter containing newline characters. A remote attacker can supply a crafted section name to inject arbitrary section headers into .git/config and execute arbitrary code.
User interaction is required to trigger a git hook after the malicious configuration is written.
22) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-67325)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to incomplete list of disallowed inputs in the check_unsafe_options option validation in GitPython when processing attacker-controlled keyword argument keys for git clone, fetch, pull, or push operations. A remote user can supply a specially crafted abbreviated long option to execute arbitrary code.
Exploitation requires a host application to pass attacker-controlled keyword argument keys into affected GitPython operations while using the default unsafe-option protection.
23) Command injection (CVE-ID: CVE-2026-67323)
CWE-ID: CWE-77 - Command injection
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary commands.
The vulnerability exists due to command injection in Repo.archive() and git.ls_remote() when processing caller-supplied Git options. A remote attacker can supply crafted option values such as exec or upload_pack to execute arbitrary commands.
The command execution occurs under default Git configuration.
24) Information disclosure (CVE-ID: CVE-2026-67322)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information to an unauthorized actor in Repo.clone_from() and Git.polish_url() when processing an attacker-controlled clone URL. A remote attacker can supply a crafted URL containing environment-variable tokens to disclose sensitive information.
The issue affects non-Cygwin platforms, where environment-variable expansion is applied to the clone URL before it is passed to git clone.
25) Input validation error (CVE-ID: CVE-2026-44244)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to improper input validation in GitConfigParser.set_value() when writing user-supplied configuration values to .git/config. A local user can inject newline characters to create a malicious core.hooksPath setting and execute arbitrary code.
Any Git operation that invokes hooks, such as commit, merge, or checkout, may trigger execution from the attacker-controlled path. In shared repositories, the injected configuration can persist and affect subsequent Git operations by other users.
26) Path traversal (CVE-ID: CVE-2026-44243)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to write, overwrite, move, or delete files outside the repository's .git directory.
The vulnerability exists due to path traversal in GitPython reference APIs when processing application-controlled reference paths in reference creation, rename, and delete operations. A local user can supply a crafted reference path to write, overwrite, move, or delete files outside the repository's .git directory.
Exploitation requires the ability to influence reference names supplied by the consuming application.
27) Input validation error (CVE-ID: CVE-2026-42284)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in _clone() and Submodule.update() when processing user-supplied multi_options. A remote attacker can supply a specially crafted option string that is transformed by shlex.split to inject unsafe git clone options and execute arbitrary code.
The issue occurs because validation is performed on the original option list before the transformed arguments are passed to git, allowing embedded --config core.hooksPath settings to reach git during clone operations.
Remediation
Install update from vendor's website.