Red Hat Security Advisory

RHSA-2026:63354

Technical preview of the satellite/iop-vmaas-rhel9 container image

Released 2026-09-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9

Fixes 3 records

TI-2026-47618 CVE-2026-67322 · GHSA-rwj8-pgh3-r573

GitPython before 3.1.52 Environment Variable Exfiltration via clone_from

HIGH 77

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from().

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00328 Published 2026-08-01 Partial fix · 3.1.52 CWE-200

TI-2026-47621 CVE-2026-67325 · GHSA-2f96-g7mh-g2hx

GitPython before 3.1.51 Command Injection via option prefix abbreviation

HIGH 73

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.02209 Published 2026-08-01 Partial fix · 3.1.51 CWE-78

TI-2026-47619 CVE-2026-67323 · GHSA-956x-8gvw-wg5v

GitPython before 3.1.51 Command Injection via unguarded Git options

HIGH 72

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbi…

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.01251 Published 2026-08-01 Partial fix · 3.1.51 CWE-77