Nbdime's GitPython integration has a vulnerability where submodule paths are validated too late, allowing cloning into the live .git/hooks directory. This enables planting an attacker-controlled executable hook that runs on subsequent git operations, leading to arbitrary code execution. Versions from 3.1.x through 3.2.0+ are affected, with 3.2.0+ raising a ValueError after the malicious hook is already written. The issue is fixed in version 4.0.4_11.
CVE-2026-100689 is a path traversal vulnerability in GitPython 3.1.61 and main branch affecting the handling of the .gitmodules 'path' field during submodule updates. The vulnerability arises because the 'path' field is used without proper containment checks, allowing an attacker to specify a path outside the repository directory. This can lead to directory creation and file writes outside the intended repository location. The issue is mitigated in common workflows since Git prevents checkout of trees with '..' components, but it can be triggered when updating submodules at non-HEAD commits via the API. A fix is available in GitPython version 4.0.4_9 that applies the existing containment guard to the 'path' field.
GitPython contains a Regular Expression Denial of Service (ReDoS) vulnerability in the Actor.name_email_regex pattern used to parse commit author and committer headers. The regex causes catastrophic backtracking when processing a commit with a long string containing an unterminated '<' character, leading to CPU exhaustion proportional to the square of the input length. This can block GitPython API calls that access commit author or committer metadata for extended periods, impacting CI runners, code-hosting backends, and repository scanning tools that process untrusted commits.
GitPython version 3.1.59 contains a vulnerability where it incorrectly resolves the git directory path, allowing attacker-controlled repository content to impersonate the .git directory. This misresolution leads to execution of attacker-supplied hooks during a commit operation, arbitrary file reads outside the repository via crafted config files, and potential writes to attacker-chosen locations. The issue arises because GitPython tests certain files before the actual .git directory, causing it to treat the working tree root as the git directory. This flaw affects services that open or clone untrusted repositories using GitPython and perform commits via its native index.commit() method.
GitPython versions up to 3.1.58 contain a vulnerability in the TagReference.create() method where a positional 'reference' argument can bypass the unsafe option guard for '--file', allowing an attacker to read arbitrary local files. This occurs because the guard only inspects keyword arguments, not positional ones, enabling an attacker to supply '--file=<path>' as a positional reference. The file contents are returned in the annotated tag message. A fix is available in version 4.0.4_8.
GitPython versions >=1.1.0 and <4.0.4_8 contain a vulnerability where the clone_from() and clone() methods do not block the --separate-git-dir option by default, despite documentation stating otherwise. This allows an attacker controlling input to specify an arbitrary filesystem path for the Git metadata directory during cloning, potentially creating files and directories outside the intended clone destination. The vulnerability arises from an incomplete denylist of unsafe git clone options, omitting --separate-git-dir, which is recognized as unsafe in other contexts within GitPython.
GitPython versions up to 3.1.58 have an incomplete denylist for unsafe git revision options in the Repo.blame() and Repo.blame_incremental() methods. This flaw allows an attacker to use the --contents or -S options to read arbitrary local files by injecting these options into the revision parameter, bypassing the denylist which only blocks write-related options. The file contents are then included in the blame result returned to the caller, potentially exposing sensitive information. A fix is available in version 4.0.4_8.
GitPython versions from 1.1.0 up to but not including 4.0.4_8 contain a vulnerability in the handling of multi-line git config values. When a multi-line value is read from disk and later rewritten by GitPython, the re-serialization process corrupts the value, injecting new live git config directives. This can lead to arbitrary code execution via the core.hooksPath configuration, which is honored by git hook operations.
GitPython versions from 1.1.0 up to but not including 4.0.4_8 contain a vulnerability where the SubmoduleConfigParser used to parse the .gitmodules file follows [include] directives without proper path restrictions. This allows an attacker controlling the .gitmodules file to cause the parser to read arbitrary local files. When the included file is not a valid git config, the parser raises an exception that leaks the first line of the file in the error message. This leads to local file content disclosure of the first line of any readable file on the victim's system during routine submodule enumeration.
GitPython versions prior to 4.0.4_7 contain a vulnerability where an attacker-controlled submodule name in a cloned repository's .gitmodules file can cause GitPython to create and initialize a Git repository outside the intended working directory. This occurs because GitPython does not validate the submodule name, allowing directory traversal sequences that escape the clone directory. The vulnerability requires the victim to clone a malicious repository and run submodule initialization via GitPython. Core Git itself mitigates this attack, but GitPython's independent implementation lacks this check.
GitPython versions up to 3.1.57 contain a vulnerability in the config-name validator that allows injection of arbitrary git configuration directives via crafted option names. The validator fails to reject characters such as '=', '#', ';', '[', ']', and whitespace in option names, enabling attackers to forge config directives like core.sshCommand or core.hooksPath. This can lead to remote code execution on subsequent git operations that use these config values. The issue arises because the safety checks applied to section names are not applied to option names. A fix is available in version 4.0.4_7.
GitPython versions up to 3.1.57 contain a vulnerability where the unsafe git option guard can be bypassed by using split_single_char_options=False combined with a single-character keyword argument. This allows an attacker to smuggle a short-option token that Git interprets as a command, leading to arbitrary OS command execution during operations like clone, fetch, or push. The vulnerability is an incomplete fix of a previous issue and affects all guarded methods forwarding kwargs with the vulnerable pattern.
GitPython's Repo.init method forwards keyword arguments directly to git init without guarding against unsafe options. This allows an attacker who can control the template parameter to specify a directory containing malicious git hooks, which are copied into the new repository's hooks directory and executed on subsequent git operations, resulting in arbitrary code execution. The vulnerability affects GitPython versions up to 3.1.57. A fix is available in version 4.0.4_7 that adds checks to prevent unsafe options like --template from being used.
GitPython versions from 1.1.0 up to but not including 4.0.4_7 contain a vulnerability in the IndexFile.remove() and Head.checkout() methods. These methods forward arbitrary keyword arguments into underlying git commands without proper validation, allowing an attacker to use the combination of --pathspec-from-file and --pathspec-file-nul flags to cause Git to treat the entire contents of a specified file as a pathspec. When the pathspec does not match any files, Git outputs the entire file content verbatim in the error message, which GitPython surfaces in the GitCommandError.stderr. This results in an arbitrary file read disclosure to the caller. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity) and is fixed in version 4.0.4_7.
GitPython versions up to 3.1.57 contain a vulnerability in the IndexFile.from_tree, reset, and merge_tree methods where unguarded forwarding of positional treeish arguments to 'git read-tree' allows an attacker to inject the '--index-output' option. This leads to arbitrary file overwrite with a valid git-index blob at the privileges of the host process. The vulnerability does not allow arbitrary code execution but can corrupt or destroy files at attacker-controlled writable paths. A fix is available in version 4.0.4_7.
GitPython versions up to 3.1.53 contain a vulnerability in the check_unsafe_options guard that allows bypass via single-character keyword argument value token smuggling. This enables arbitrary OS command execution through the --upload-pack git option in all guarded methods such as clone, fetch, pull, and others. The flaw arises because the guard inspects only the keys of kwargs for unsafe options, ignoring malicious tokens embedded in the values that become separate argv tokens. This vulnerability is fixed in version 4.0.4_5.
GitPython's Diffable.diff() method improperly forwards user-supplied arguments directly to git diff commands without validating unsafe options. This allows an attacker to inject the '--output' argument, causing git to overwrite arbitrary files with diff content at the process privilege level. The vulnerability affects versions up to 3.1.53 and has been fixed in version 4.0.4_5.
GitPython versions from 1.1.0 up to but not including 4.0.4_5 contain a vulnerability where environment variables in URLs passed to Repo.create_remote() or Remote.add() are expanded and embedded into the repository configuration. This can lead to sensitive environment variables being exfiltrated to attacker-controlled hosts during git fetch or pull operations. The vulnerability arises because the fix for a previous similar issue did not cover these API calls, leaving the default behavior of expanding environment variables in URLs intact. A patch is available in version 4.0.4_5 that addresses this issue.
GitPython versions up to 3.1.53 contain a vulnerability in the Commit.count() method where unguarded forwarding of options to git rev-list allows an attacker to specify an --output argument. This causes git rev-list to truncate an arbitrary file to zero bytes, leading to file destruction. The vulnerability is due to missing unsafe option checks in Commit.count(), unlike sibling methods that have such guards. The impact is medium severity as it allows file truncation at the process privilege level but does not allow content control or arbitrary file creation.
GitPython versions up to 3.1.53 have an incomplete denylist for unsafe git clone options that omits the --template option. This omission allows an attacker who can influence clone options and stage a malicious post-checkout hook in a directory to achieve arbitrary command execution during a git clone operation. The vulnerability requires the attacker to have write access to a directory used as a template containing executable hooks. A fix is available in version 4.0.4_5.