SB2026110931 - Debian update for python-git
Published: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 38 vulnerabilities.
1) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-87818)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper neutralization of argument delimiters in the high-level diff API when processing attacker-influenced diff options and path operands with --no-index and --ignore-matching-lines. A remote user can send crafted diff options and filesystem path operands to disclose sensitive information.
Exploitation requires an embedding application to expose a distinguishable success or error result and to allow repeated requests.
2) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-76220)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary commands.
The vulnerability exists due to improper neutralization of argument delimiters in a command in the unsafe option guard for git kwargs handling when processing user-controlled keyword arguments with split_single_char_options disabled. A remote user can supply a crafted single-character option value that is transformed into a joined short-option token to execute arbitrary commands.
Exploitation requires an application to forward a user-controlled kwargs dictionary to a guarded GitPython method such as clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in the GitPython config writer when writing attacker-controlled option names into git configuration files. A remote user can supply a crafted option name to forge git configuration directives and execute arbitrary code.
Exploitation requires an embedding application to pass a caller-influenced option name to the configuration writer, and code execution occurs on a subsequent git operation such as an ssh git action or hook execution.
4) Path traversal (CVE-ID: CVE-2026-76222)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to create arbitrary Git repositories outside the working tree.
The vulnerability exists due to path traversal in submodule initialization logic when processing a cloned repository's .gitmodules submodule name during submodule initialization. A remote attacker can supply a specially crafted repository with a traversal string in the submodule name to create arbitrary Git repositories outside the working tree.
User interaction is required to clone the malicious repository and run submodule initialization.
5) External Control of File Name or Path (CVE-ID: CVE-2026-78675)
CWE-ID: CWE-73 - External Control of File Name or Path
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information from arbitrary local files.
The vulnerability exists due to external control of file name or path in SubmoduleConfigParser and GitConfigParser when parsing an untrusted .gitmodules file containing an [include] directive. A remote attacker can supply a crafted repository whose .gitmodules references a readable local file to disclose sensitive information from arbitrary local files.
The disclosure occurs through an uncaught parsing exception that embeds the first line of the referenced file in the error message during submodule enumeration.
6) Code Injection (CVE-ID: CVE-2026-78676)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to code injection in GitConfigParser._write()/write_section() in git/config.py when re-serializing previously parsed multi-line git-config values during an unrelated config write. A remote attacker can supply a crafted config value that is rewritten into a live injected directive such as core.hooksPath to execute arbitrary code.
Exploitation requires an attacker-influenced config file to be opened read-write and later flushed through any legitimate write operation. The injected directive becomes active on a subsequent hook-firing git operation.
7) Path traversal (CVE-ID: CVE-2026-78677)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to create an arbitrary git directory outside the intended destination.
The vulnerability exists due to improper limitation of a pathname to a restricted directory in Repo.clone_from()/Repo.clone() option handling when forwarding a caller-controlled separate_git_dir argument to git clone. A remote attacker can supply a specially crafted separate_git_dir path to create an arbitrary git directory outside the intended destination.
Exploitation requires a host application to pass attacker-influenced clone options to the API without rejecting the separate_git_dir argument.
8) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-78678)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper neutralization of argument delimiters in Repo.blame() and Repo.blame_incremental() when processing a caller-influenced revision value. A remote user can pass a specially crafted revision option such as --contents=<path> or -S <file> to disclose sensitive information.
The file contents are echoed into the blame result returned to the caller, and the issue occurs with the default allow_unsafe_options=false setting.
9) Argument injection (CVE-ID: CVE-2026-78679)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper neutralization of argument delimiters in TagReference.create() when forwarding a caller-influenced positional reference value to git tag. A remote user can supply a reference value containing a --file option to disclose sensitive information.
Exploitation requires an embedding application to forward a caller-influenced reference value to TagReference.create().
10) Insecure DLL loading (CVE-ID: CVE-2026-87817)
CWE-ID: CWE-427 - Uncontrolled Search Path Element
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to uncontrolled search path resolution in Repo.__init__ and commit hook path handling when opening or cloning a crafted repository and performing index.commit(). A remote attacker can place crafted repository-root files and a malicious hooks/pre-commit script to execute arbitrary code.
User interaction is required to open or clone the crafted repository.
11) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-76219)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite arbitrary files.
The vulnerability exists due to improper neutralization of argument delimiters in a command in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree when appending caller-influenced treeish arguments to git read-tree. A remote user can supply a specially crafted treeish value to overwrite arbitrary files.
The overwritten content is constrained to a valid git index blob rather than attacker-chosen file contents.
12) Inefficient regular expression complexity (CVE-ID: CVE-2026-87819)
CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in Actor.name_email_regex in git/util.py when parsing the author or committer header of a git commit object containing a long string with an unterminated < character. A remote attacker can supply a specially crafted commit object to cause a denial of service.
The issue is triggered when GitPython resolves commit metadata such as .author or .committer from repositories or commit objects obtained from untrusted sources.
13) Path traversal (CVE-ID: CVE-2026-100689)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to create and populate directories outside the repository working tree.
The vulnerability exists due to improper limitation of a pathname to a restricted directory in the submodule update path in git/objects/submodule/base.py when processing a crafted .gitmodules path during a submodule update. A remote attacker can supply a crafted .gitmodules path to create and populate directories outside the repository working tree.
Exploitation requires application code to select a non-HEAD commit through a historical-commit submodule-update API.
14) Information disclosure (CVE-ID: CVE-2026-110855)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper neutralization of environment-variable expansion in Repo._clone() when initializing submodules from a cloned repository with a crafted .gitmodules submodule name. A remote attacker can cause environment variables to be expanded in the separate_git_dir path to disclose sensitive information.
User interaction is required to clone the malicious repository and initialize its submodules.
15) Inefficient regular expression complexity (CVE-ID: CVE-2026-110856)
CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in the _re_actor_epoch regular expression used by parse_actor_and_date when processing malformed author, committer, or tagger lines in commit or tag objects. A remote attacker can supply a crafted commit or tag object to cause a denial of service.
Exploitation requires an application to read the affected actor field from an untrusted repository.
16) Improper Validation of Specified Type of Input (CVE-ID: CVE-2026-110857)
CWE-ID: CWE-1287 - Improper Validation of Specified Type of Input
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper validation of specified input type in Git.ls_remote when processing a caller-supplied remote URL. A remote attacker can supply an ext:: remote-helper URL to execute arbitrary code.
Exploitation requires user interaction and a Git transport policy that permits the ext transport.
17) Argument injection (CVE-ID: CVE-2026-110858)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary commands.
The vulnerability exists due to improper neutralization of argument delimiters in GitPython Remote.pull() when processing attacker-influenced refspec values. A remote attacker can supply an option-shaped refspec that bypasses the unsafe-option guard to execute arbitrary commands.
Exploitation requires a local filesystem path or SSH transport, where the supplied upload-pack program is executed on the local side.
18) Link following (CVE-ID: CVE-2026-110860)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to move a submodule checkout outside the worktree and corrupt repository state.
The vulnerability exists due to improper link resolution before file access in Submodule.move() when processing a fixed move destination below an attacker-committed intermediate symbolic link. A remote attacker can commit a symbolic link in an untrusted repository to move an initialized submodule checkout to an external directory and corrupt repository state.
User interaction is required for an application to initialize the submodule and call Submodule.move() with the fixed destination. The issue applies where Git materializes tracked symbolic links as real symbolic links.
19) Incorrect behavior order (CVE-ID: CVE-2026-114145)
CWE-ID: CWE-696 - Incorrect Behavior Order
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to execute arbitrary code with the victim application's privileges.
The vulnerability exists due to GitPython validating submodule paths only after cloning into the repository's .git directory. An unauthenticated remote attacker can supply a malicious submodule with path .git/hooks to an application accepting untrusted submodule specifications, planting an executable hook when that directory is empty and triggering execution when a victim subsequently performs a checkout.
20) External Control of File Name or Path (CVE-ID: CVE-2026-73619)
CWE-ID: CWE-73 - External Control of File Name or Path
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to external control of file name or path in Repo.archive() when processing caller-influenced archive options. A remote user can supply a crafted --add-file option to disclose sensitive information.
Exploitation requires an application to forward caller-influenced keyword arguments into Repo.archive().
21) Input validation error (CVE-ID: CVE-2026-42284)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in _clone() and Submodule.update() when processing user-supplied multi_options. A remote attacker can supply a specially crafted option string that is transformed by shlex.split to inject unsafe git clone options and execute arbitrary code.
The issue occurs because validation is performed on the original option list before the transformed arguments are passed to git, allowing embedded --config core.hooksPath settings to reach git during clone operations.
22) Path traversal (CVE-ID: CVE-2026-44243)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to write, overwrite, move, or delete files outside the repository's .git directory.
The vulnerability exists due to path traversal in GitPython reference APIs when processing application-controlled reference paths in reference creation, rename, and delete operations. A local user can supply a crafted reference path to write, overwrite, move, or delete files outside the repository's .git directory.
Exploitation requires the ability to influence reference names supplied by the consuming application.
23) Input validation error (CVE-ID: CVE-2026-44244)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to improper input validation in GitConfigParser.set_value() when writing user-supplied configuration values to .git/config. A local user can inject newline characters to create a malicious core.hooksPath setting and execute arbitrary code.
Any Git operation that invokes hooks, such as commit, merge, or checkout, may trigger execution from the attacker-controlled path. In shared repositories, the injected configuration can persist and affect subsequent Git operations by other users.
24) Information disclosure (CVE-ID: CVE-2026-67322)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information to an unauthorized actor in Repo.clone_from() and Git.polish_url() when processing an attacker-controlled clone URL. A remote attacker can supply a crafted URL containing environment-variable tokens to disclose sensitive information.
The issue affects non-Cygwin platforms, where environment-variable expansion is applied to the clone URL before it is passed to git clone.
25) Command injection (CVE-ID: CVE-2026-67323)
CWE-ID: CWE-77 - Command injection
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary commands.
The vulnerability exists due to command injection in Repo.archive() and git.ls_remote() when processing caller-supplied Git options. A remote attacker can supply crafted option values such as exec or upload_pack to execute arbitrary commands.
The command execution occurs under default Git configuration.
26) OS Command Injection (CVE-ID: CVE-2026-67324)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute a local command.
The vulnerability exists due to improper neutralization of special elements used in an os command in the Repo.clone_from unsafe clone option gate when processing attacker-influenced clone options in multi_options. A remote user can supply a joined short option such as -u<helper> to execute a local command.
Exploitation requires an application to pass attacker-influenced clone options into Repo.clone_from(..., multi_options=...) while relying on the default unsafe-option gate to block unsafe clone options.
27) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-67325)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to incomplete list of disallowed inputs in the check_unsafe_options option validation in GitPython when processing attacker-controlled keyword argument keys for git clone, fetch, pull, or push operations. A remote user can supply a specially crafted abbreviated long option to execute arbitrary code.
Exploitation requires a host application to pass attacker-controlled keyword argument keys into affected GitPython operations while using the default unsafe-option protection.
28) Input validation error (CVE-ID: CVE-2026-67326)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in config_writer() and set_value() in git/config.py when processing a crafted section parameter containing newline characters. A remote attacker can supply a crafted section name to inject arbitrary section headers into .git/config and execute arbitrary code.
User interaction is required to trigger a git hook after the malicious configuration is written.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements in git config section names in the GitPython config writer when writing attacker-controlled submodule names into the parent repository's .git/config. A remote attacker can supply a specially crafted submodule name to inject arbitrary config directives and execute arbitrary code.
User interaction is required for the victim to perform a subsequent git operation that uses the injected configuration, and the issue is reachable via untrusted .gitmodules data during submodule initialization or via applications that create submodules from untrusted input.
30) OS Command Injection (CVE-ID: CVE-2026-42215)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to command injection in Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() when processing attacker-controlled kwargs that are normalized into unsafe Git options. A remote user can supply crafted upload_pack or receive_pack values to execute arbitrary code.
The issue occurs because underscore-form kwargs bypass the unsafe-option check before being converted into dangerous command-line flags, and it does not require a malicious repository.
31) External Control of File Name or Path (CVE-ID: CVE-2026-73620)
CWE-ID: CWE-73 - External Control of File Name or Path
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite arbitrary files.
The vulnerability exists due to external control of file name or path in IndexFile.checkout() when forwarding user-supplied git options to git checkout-index. A remote user can supply a crafted prefix option to overwrite arbitrary files.
The written content is taken from repository-controlled tracked files, and the overwrite can occur outside the working tree.
32) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-73621)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to truncate an arbitrary file.
The vulnerability exists due to improper neutralization of argument delimiters in a command in Commit.count when forwarding user-supplied keyword arguments to git rev-list. A remote user can supply a crafted output argument to truncate an arbitrary file.
The file is truncated to 0 bytes at the privilege level of the running process.
33) Information disclosure (CVE-ID: CVE-2026-73622)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in Repo.create_remote(), Remote.add(), and Submodule.add() when processing an attacker-controlled repository URL. A remote attacker can supply a URL containing environment-variable references to disclose sensitive information.
The supplied variable references are expanded server-side, stored in .git/config, and the resulting secret-bearing URL is transmitted on the next fetch, pull, or remote update. In the Submodule.add() path, the expanded URL is also written to .gitmodules.
34) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-73623)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary commands.
The vulnerability exists due to an incomplete list of disallowed inputs in unsafe_git_clone_options in base.py when processing clone options. A remote user can supply the --template option pointing to a directory containing a crafted hook to execute arbitrary commands.
Exploitation requires an attacker-readable directory containing an executable hook, and the post-checkout hook is executed during clone.
35) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-73624)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite arbitrary files.
The vulnerability exists due to improper neutralization of argument delimiters in a command in Diffable.diff when forwarding user-controlled arguments to git diff or git diff-tree. A remote user can supply a crafted output argument or a crafted other value to overwrite arbitrary files.
The issue affects both key-controlled and value-controlled input paths because the caller-supplied other reference is inserted before the -- separator and can be parsed as a git option.
36) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-73625)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary os commands.
The vulnerability exists due to improper neutralization of argument delimiters in a command in the check_unsafe_options guard and single-character kwarg transformation logic when processing user-supplied keyword arguments for guarded git methods. A remote user can supply a single-character kwarg value that is transformed into a separate unsafe git option token to execute arbitrary os commands.
In the default configuration, the issue affects guarded methods including clone, fetch, pull, push, ls_remote, iter_commits, blame, and archive.
37) Information disclosure (CVE-ID: CVE-2026-76217)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in IndexFile.remove() and Head.checkout() when forwarding user-supplied keyword arguments to git rm and git checkout. A remote user can supply a crafted pathspec_from_file value together with pathspec_file_nul to disclose sensitive information.
The targeted file must be readable by the process, and disclosure occurs in the returned GitCommandError stderr when the supplied pathspec does not match a tracked path.
38) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-76218)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper neutralization of argument delimiters in Repo.init when forwarding user-supplied git options to git init. A remote user can supply a crafted template option to plant a hook that executes on the next git operation to execute arbitrary code.
Exploitation requires the application to pass an attacker-controlled template argument and for an executable hook directory to be staged at a known path.
Remediation
Install update from vendor's website.