GCVE - cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Gitpython Project (`bdd16a99-3102-5470-9de2-6c63ba069300`)
Product	Gitpython (`625429b6-e8ab-502f-8703-212f5c2d7b74`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/logaraj82/gitpython`	purl2cpe	2026-06-01 10:14:55.666638
`pkg:github/gitpython-developers/gitpython`	purl2cpe	2026-06-01 10:14:55.666641
`pkg:pypi/gitpython`	purl2cpe	2026-06-01 10:14:55.666644
`pkg:rpm/fedora/gitpython`	purl2cpe	2026-06-01 10:14:55.666647
`pkg:rpm/opensuse/gitpython`	purl2cpe	2026-06-01 10:14:55.666650

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-110855`	vulnerable	2026-11-03 10:16:01.116587	GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name MEDIUM (6.5) GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs. Published: 2026-10-14T22:52:34.854Z Updated: 2026-10-15T18:15:45.736Z Open on db.gcve.eu Reference links https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fx3j-rwgx-fr94 https://www.vulncheck.com/advisories/gitpython-before-3.2.0-environment-variable-disclosure-via-gitmodules-submodule-name	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-110860`	vulnerable	2026-11-03 10:16:01.085974	GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move() MEDIUM (6.1) GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules. Published: 2026-10-14T22:52:44.690Z Updated: 2026-10-26T15:27:14.246Z Open on db.gcve.eu Reference links https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-gq48-pqfc-9p58 https://www.vulncheck.com/advisories/gitpython-3.1.62-before-3.2.0-symlink-path-traversal-via-submodule-move	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-110856`	vulnerable	2026-11-03 10:16:00.485231	GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date HIGH (7.5) GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion. Published: 2026-10-14T22:52:38.541Z Updated: 2026-10-20T02:25:27.631Z Open on db.gcve.eu Reference links https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-m64x-33q8-m5h7 https://www.vulncheck.com/advisories/gitpython-before-3.2.0-redos-via-re-actor-epoch-in-parse-actor-and-date	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-87819`	vulnerable	2026-09-16 04:33:01.648856	GitPython before 3.1.60 Denial of Service via ReDoS HIGH (7.5) GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access. Published: 2026-09-09T11:21:05.360Z Updated: 2026-10-08T15:25:57.646Z Open on db.gcve.eu Reference links https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-87818`	vulnerable	2026-09-16 04:33:01.424204	GitPython 3.1.59 Local File Content Oracle via --no-index MEDIUM (6.5) GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses. Published: 2026-09-09T11:21:04.681Z Updated: 2026-10-08T15:25:57.055Z Open on db.gcve.eu Reference links https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-whh4-5q6c-9v3x https://www.vulncheck.com/advisories/gitpython-3.1.59-local-file-content-oracle-via-no-index	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-87817`	vulnerable	2026-09-16 04:33:01.054371	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Gitpython

Notes

PURL mappings

Vulnerability references

Contribute