GitPython's Repo.init() method forwards keyword arguments directly to git init without guarding unsafe options like --template. This allows an attacker who can control the template path to plant malicious git hooks that execute arbitrary code during subsequent git operations. The vulnerability affects GitPython versions up to 3.1.57 and is fixed in version 9.25.1. Exploitation requires the attacker to stage an executable hook directory and influence the template argument passed to Repo.init().
GitPython versions prior to 9.25.1 have a vulnerability in the IndexFile.remove() and Head.checkout() methods where passing the --pathspec-from-file option together with --pathspec-file-nul causes Git to treat the entire file as a single NUL-delimited pathspec. When the pathspec does not match any files, Git returns an error message that includes the entire contents of the specified file. This results in an arbitrary file read vulnerability where the contents of a caller-chosen file are exposed via the GitCommandError.stderr output.
GitPython versions up to 3.1.53 contain a vulnerability in the check_unsafe_options guard that can be bypassed by smuggling a malicious git option token inside the value of a single-character keyword argument. This bypass allows arbitrary OS command execution via the --upload-pack option in various guarded methods such as clone, fetch, pull, and others. The vulnerability arises because the guard only inspects option keys, not values, enabling injection of dangerous commands. A fix is available in version 9.23.1_2.
GitPython versions up to 3.1.53 contain a vulnerability in the Diffable.diff() method that allows arbitrary file overwrite via injection of the git diff --output argument. The method forwards user-supplied keyword arguments directly to git diff commands without validating unsafe options, enabling an attacker to specify a file path to overwrite with diff content at the process privilege level.
GitPython versions up to 3.1.53 have an incomplete denylist for unsafe git clone options that omits the --template option. This omission allows an attacker who can influence clone options and stage a malicious post-checkout hook in a directory to achieve arbitrary command execution during a git clone operation. The vulnerability requires the attacker to have write access to a directory used as a template containing executable hooks. The issue is fixed in version 9.23.1_2.
GitPython versions from 5.5.3 up to but not including 9.23.1_2 contain a vulnerability where environment variables in URLs passed to Repo.create_remote() or Remote.add() are expanded and embedded into the repository configuration. This can lead to sensitive environment variables being written into .git/config and transmitted over the network to an attacker-controlled host during fetch or pull operations. The vulnerability arises because the fix for a previous similar issue only covered Repo.clone_from(), leaving other URL handling calls vulnerable. A fix is available in version 9.23.1_2.
GitPython's Commit.count() method improperly forwards user-supplied options to git rev-list without safety checks, allowing an attacker with process-level privileges to truncate arbitrary files to zero bytes. This vulnerability affects versions up to 3.1.53 and was fixed in version 9.24.0. The impact is limited to file destruction (integrity and availability) without content control, resulting in a medium severity rating.
GitPython versions from 5.5.3 up to but not including 9.24.0 contain unguarded forwarding of git command options in certain API methods, allowing arbitrary file overwrite and arbitrary file read. Specifically, the IndexFile.checkout() method forwards unsafe options to 'git checkout-index' enabling an attacker to overwrite arbitrary files with repository-controlled content via the --prefix option. The TagReference.create() method forwards unsafe options to 'git tag' allowing an attacker to read arbitrary files via the -F/--file option. These vulnerabilities arise because the methods do not invoke the internal safety checks that block dangerous git options. A fix is available in version 9.24.0.
GitPython's Repo.archive() method uses a denylist to block unsafe git archive options but omits the --add-file and --add-virtual-file options. These omitted options allow an attacker to read arbitrary files from the filesystem or inject attacker-controlled content into an archive, potentially exposing sensitive data. The vulnerability requires the embedding application to forward caller-controlled options to Repo.archive(). A fix is available in GitPython version 9.24.0.
A vulnerability in GitPython's config_writer() allows newline injection in the section parameter, bypassing the patch for CVE-2026-42215. This enables an attacker to inject arbitrary section headers into the .git/config file, including a forged [core] section with hooksPath pointing to an attacker-controlled directory. This leads to remote code execution (RCE) when any git hook is triggered. The issue affects Snakemake versions >=5.5.3 and <9.20.0_1 and is fixed in version 9.20.0_1.
GitPython version 3.1.50 contains a vulnerability where the default unsafe-option gate intended to block dangerous git clone options can be bypassed using joined short-option forms such as '-u<helper>'. This allows execution of local commands via Git's upload-pack option despite the protection being enabled. The issue arises because the option canonicalization does not recognize joined short options as unsafe, leading to a residual security bypass.
GitPython versions from 5.5.3 up to but not including 9.23.1_1 contain command injection vulnerabilities due to insufficient validation of user-supplied options in several GitPython methods such as Repo.archive(), git.ls_remote(), and Repo.iter_commits(). These flaws allow attackers to execute arbitrary commands or cause file truncation by injecting malicious options that are passed directly to underlying Git commands without proper sanitization.
GitPython versions up to 3.1.50 contain a vulnerability where the Repo.clone_from() method passes the remote URL through os.path.expandvars(), causing environment variables in the URL to be expanded. This can lead to secret environment variables being embedded in the URL and exfiltrated to an attacker-controlled host. The flaw arises because polish_url() applies environment variable expansion indiscriminately to remote URLs without validation or opt-out. A fix is available in version 9.23.1_1.
GitPython's config_writer().set_value() method does not validate input values for newline characters, allowing injection of a crafted core.hooksPath configuration. This enables an attacker to control Git hook execution paths, leading to remote code execution when Git operations invoke hooks. The vulnerability affects GitPython versions from 5.5.3 up to but not including 9.20.0. A fix is available in version 9.20.0 that rejects values containing CR, LF, or NUL characters.
A path traversal vulnerability exists in GitPython reference APIs used by Snakemake (CVE-2026-44243) that allows attackers to write, overwrite, move, or delete files outside the repository's .git directory. This occurs due to insufficient validation of reference paths before filesystem write, rename, and delete operations. The flaw affects Snakemake versions from 5.5.3 up to but not including 9.20.0. The vulnerability requires local access and the ability to supply crafted reference paths to the application using GitPython. The impact includes high integrity and availability risks, such as arbitrary file modification and deletion. A fix is available in Snakemake version 9.20.0.
GitPython versions from 5.5.3 up to but not including 9.20.0 contain a vulnerability in the handling of multi_options in clone operations. The validation of unsafe options is performed on the original list of options before they are transformed by shlex.split, allowing an attacker to embed unsafe options like '--config core.hooksPath=...' inside a string that passes validation but is split into multiple options at execution time. This leads to execution of attacker-controlled Git hooks during cloning or submodule updates.
GitPython, as used in Snakemake versions 7.20.0 up to but not including 9.20.0, contains a command injection vulnerability (CVE-2026-42215). This occurs because unsafe Git options such as --upload-pack and --receive-pack are blocked by name, but their equivalent Python keyword arguments with underscores (upload_pack, receive_pack) bypass this check and allow arbitrary command execution. The vulnerability affects methods like Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() when attacker-controlled kwargs are passed. A fix is available in version 9.20.0.
GitPython versions up to 3.1.52 contain a vulnerability where specially crafted submodule names can inject arbitrary configuration directives into the .git/config file. This occurs because the config writer only blocks CR, LF, and NUL characters in section names but does not escape characters like ] or [ that can break the config syntax. An attacker can exploit this to set directives such as core.sshCommand, enabling remote code execution on the victim's next git operation.
GitPython versions from 5.5.3 up to but not including 9.23.1_1 contain a command injection vulnerability (CVE-2026-67325) due to incomplete blocking of unsafe git options. The vulnerability arises because the fix for a previous issue (CVE-2026-42215) only blocks exact matches of dangerous git options but does not account for git's acceptance of unambiguous long-option prefix abbreviations. This allows attackers to bypass the blocklist by using abbreviated option keys that are translated into dangerous git commands, leading to remote code execution when attacker-controlled keys are passed to GitPython clone, fetch, pull, or push operations. A fix is available in version 9.23.1_1.
CVE-2024-22190 is a high-severity vulnerability in the Legit tool related to GitPython's handling of untrusted search paths on Windows. It allows arbitrary code execution if GitPython runs git commands through a shell or executes bash.exe to interpret hooks, potentially running malicious executables from untrusted repository directories. This vulnerability is a result of incomplete mitigation of a previous issue (CVE-2023-40590).