GitPython package vulnerabilities
Advisories affecting the GitPython package. A list cannot tell you whether your installed version is affected — the dependency check can.
6 vulnerabilities tracked.
Check which version you are running → — this page lists advisories for the package; only a version check can tell you whether you are affected.
- 8.7 GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
- 8.1 GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
- 7.5 GitPython command wrappers omit unsafe protocol and option checks
- 7.1 GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
- 6.5 GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
- — GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that GitPython is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other packages tracked here
filelock node-forge github.com/labstack/echo/v5 github.com/labstack/echo/v4 vllm undici virtualenv @highcharts/dashboards adminneo-org/adminneo authlib pypdf highcharts org.keycloak:keycloak-services seroval zip org.mariadb.jdbc:mariadb-java-client @highcharts/grid-pro mlflow russh rustls onnx pyasn1 crass better-auth