Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: gitpython-developers GitPython 3.1.60 Clear all filters
TI-2026-59936 CVE-2026-87819 · GHSA-g5vv-9gxw-82hx

GitPython before 3.1.60 Denial of Service via ReDoS

Priority MEDIUM 44

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00521 Published 2026-09-09 Partial fix · 3.1.60 CWE-1333
TI-2026-59935 CVE-2026-87818

GitPython 3.1.59 Local File Content Oracle via --no-index

Priority MEDIUM 64

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00412 Published 2026-09-09 Partial fix · 3.1.60 CWE-88
TI-2026-59934 CVE-2026-87817 · GHSA-239g-whfq-7xj9

GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation

Priority MEDIUM 46

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00419 Published 2026-09-09 Partial fix · 3.1.60 CWE-94