GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method that allows an attacker to cause an arbitrary file read via a specially crafted branch name. The flaw arises because the positional branch name argument is not properly sanitized and is passed directly to the git checkout command without a separator, enabling injection of options such as --pathspec-from-file to read files like /etc/passwd. This issue is an incomplete fix of previous advisories and affects all published releases up to 3.1.62. A fix is available in version 3.2.0.
GitPython's Submodule.move() API does not properly handle symbolic links in intermediate path components, allowing an attacker controlling a Git repository with a symlinked submodule path to cause the submodule to be moved outside the parent repository's worktree. This leads to an integrity violation where repository content is relocated to an attacker-chosen directory outside the expected location, corrupting the parent repository's index and configuration. The issue affects GitPython versions prior to 3.2.0 and requires the application to explicitly call Submodule.move() on a path under the symlink. No code execution or confidentiality impact is demonstrated.
GitPython's Remote.pull() method improperly handles the positional refspec argument, allowing an attacker to inject a --upload-pack option that bypasses the unsafe-option guard. This leads to arbitrary command execution with the privileges of the calling process when using local-path or SSH transports. The vulnerability is fixed in version 3.2.0.
GitPython versions prior to 3.2.0 have security weaknesses in three command wrapper methods—ls_remote, merge_base, and IndexFile.move—that omit checks for unsafe protocols and options. This omission allows potential command injection or remote code execution (RCE) when interacting with maliciously crafted git URLs or arguments, particularly if the underlying git transport policy permits unsafe protocols like 'ext'. The vulnerability is confirmed on the main branch as of 2026-09-21 and affects versions before 3.2.0. A fix is available in version 3.2.0.
GitPython versions prior to 3.2.0 have a vulnerability in the handling of the separate_git_dir parameter during repository cloning. This flaw allows environment variable expansion from attacker-controlled .gitmodules submodule names, leading to leakage of environment variable values. The expanded values are exposed persistently on disk as directory names and in debug-level logs, potentially disclosing sensitive environment variables.
GitPython versions prior to 3.2.0 contain a vulnerability in the parse_actor_and_date() function due to a regex pattern that causes quadratic backtracking on malformed author, committer, or tagger identity lines. This results in CPU exhaustion when processing crafted commit or tag objects with malformed identity lines lacking valid epoch or timezone information. The issue was fixed in version 3.2.0 by modifying the regex to prevent overlapping matches and eliminate the backtracking.
GitPython versions prior to 3.2.1 contain a vulnerability in the create_submodule() function that allows an attacker to specify a submodule path such as .git/hooks. This can lead to the placement of an executable post-checkout hook that a subsequent Git operation executes. The issue arises because the repository cloning occurs before the path validation rejects unsafe destinations, and the planted file is not removed after the error is raised. This vulnerability is fixed in GitPython version 3.2.1.
GitPython versions from 3.1.62 up to but not including 3.2.0 contain a vulnerability in the Submodule.move() function where symbolic links in intermediate path components are not properly rejected. This allows an untrusted repository to include a symlink pointing outside the working tree, causing the application to relocate the submodule checkout externally and corrupt the index and .gitmodules file. The issue is fixed in version 3.2.0.
GitPython versions before 3.2.0 contain an argument injection vulnerability in the Head.checkout() function. This flaw allows remote attackers to read arbitrary files by supplying a specially crafted branch name that is interpreted as a git option. Specifically, an attacker can host a repository with a default branch named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents via GitCommandError messages.
GitPython versions from 3.1.30 up to but not including 3.2.0 contain a critical remote code execution vulnerability in the Remote.pull() method. The vulnerability arises because the unsafe-option guard only inspects keyword arguments and not positional refspec arguments, allowing attackers controlling the refspec to inject OS commands via the --upload-pack option. This can lead to execution of arbitrary commands as the calling process over local-path or SSH transports.
GitPython versions before 3.2.0 contain a remote code execution vulnerability due to improper validation of input types. The Git.ls_remote function forwards URLs without validating unsafe protocols, allowing attackers to supply malicious ext:: remote-helper URLs to execute commands. Additionally, merge_base and IndexFile.move functions accept unguarded option injection. This vulnerability has a high severity with a CVSS score of 7.7.
GitPython versions before 3.2.0 contain a regular expression denial of service (ReDoS) vulnerability in the _re_actor_epoch pattern used during parsing of author, committer, and tagger lines. This flaw allows attackers to cause excessive CPU consumption by serving repositories with commit or tag objects that have long space-filled lines without valid epoch or timezone information, triggering inefficient regex processing.
GitPython versions prior to 3.2.0 contain an information disclosure vulnerability. This flaw allows maliciously crafted repositories to exploit environment variable expansion in the cloning process, specifically via the separate_git_dir parameter in Repo._clone(). Attackers can use specially named submodules with variable syntax to expose sensitive information from .git/modules directory names and DEBUG logs during clone and submodule update operations.
GitPython versions before 3.1.62 contain a path traversal vulnerability in the handling of the `path` field from untrusted .gitmodules files during submodule updates. This flaw allows directory creation outside the repository working tree, potentially leading to unauthorized file system modifications. The vulnerability requires an application flow that updates submodules at a non-HEAD commit, which is less common. The issue is fixed in GitPython 3.1.62.
GitPython versions before 3.1.60 contain a regular expression denial of service (ReDoS) vulnerability in the Actor.name_email_regex component that processes commit author and committer fields. An attacker can craft a commit object with a malformed author field containing an unterminated angle bracket, causing the regex to perform quadratic backtracking. This results in excessive CPU consumption, potentially exhausting resources for over two minutes per commit access.
GitPython version 3.1.59 contains a vulnerability in its high-level diff API where the --no-index option is not properly restricted. This flaw allows attackers with limited privileges to read arbitrary filesystem paths by using the --no-index option combined with the -I/--ignore-matching-lines flag. This can be exploited as a content-dependent Boolean oracle to extract single-line secrets from local files based on success or error responses.
GitPython versions before 3.1.60 contain a code injection vulnerability due to improper validation of the git directory location. This flaw allows attackers to impersonate the git directory by manipulating tracked files such as gitdir, commondir, and HEAD. Exploitation can lead to arbitrary code execution when a victim calls index.commit() on a cloned or opened repository with a malicious pre-commit hook.
GitPython versions before 3.1.59 contain an arbitrary file read vulnerability in the TagReference.create() function. This flaw allows attackers to bypass an unsafe option guard by supplying a specially crafted positional reference parameter, such as --file=<path>, enabling them to read arbitrary files. The contents of these files are returned in the annotated tag message. The vulnerability has a high severity with a CVSS score of 7.1.
GitPython versions before 3.1.59 have a vulnerability due to an incomplete denylist in the unsafe_git_revision_options guard. This flaw allows attackers to bypass restrictions by using the --contents and -S options with the Repo.blame() method, enabling them to read arbitrary files. By supplying revision values such as --contents=/etc/passwd, attackers can leak file contents through the blame result returned to the caller.
CVE-2026-78677 is a path traversal vulnerability in GitPython before version 3.1.59. It allows attackers to manipulate the separate_git_dir parameter in cloning functions to create arbitrary git directories outside the intended clone destination. This can lead to arbitrary directory creation and potential execution of malicious hooks.