Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of Django are vulnerable to Denial-of-Service via django.utils.text.Truncator. The django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

Affected versions of the Django package are vulnerable to Denial of Service (DoS) due to inefficient string concatenation when processing duplicate HTTP headers in ASGI mode. The ASGIRequest class combines repeated headers using repeated string concatenation, resulting in super-linear (quadratic) time complexity when processing requests with many duplicate headers.

Django fixes a potential denial-of-service vulnerability in XML ``Deserializer``.

A potential denial-of-service vulnerability has been identified in Django's urlize() and urlizetrunc() functions in django.utils.html. This vulnerability can be triggered by inputting huge strings containing a specific sequence of characters.

Affected versions of the Django package are vulnerable to Path Traversal due to improper validation of archive member paths during extraction. The django.utils.archive.extract() function—used by the startapp --template and startproject --template commands—checked path prefixes instead of using canonicalised paths, allowing archive entries whose names share a prefix with the destination to resolve outside the intended directory.

Affected versions of the Django package are vulnerable to SQL Injection due to improper handling of column aliases containing periods in QuerySet.order_by() when combined with FilteredRelation. The QuerySet.order_by() method fails to properly sanitize column aliases that contain periods when the same alias is used in FilteredRelation via dictionary expansion. 
https://github.com/django/django/commit/90f5b10784ba5bf369caed87640e2b4394ea3314

Affected versions of Django are affected by a directory-traversal vulnerability in the Storage.save() method. Derived classes of the django.core.files.storage.Storage base class that overrides the generate_filename() method without replicating the file path validations existing in the parent class could allow for directory traversal via certain inputs when calling save(). This could enable an attacker to manipulate file paths and access unintended directories.

Affected versions of the Django package are vulnerable to SQL Injection due to improper sanitization of band index parameters in PostGIS raster lookups. The raster lookup functionality in Django's GIS module fails to properly validate or escape untrusted data used as a band index when performing spatial queries against PostGIS databases.

An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().

Affected versions of Django are vulnerable to a potential denial-of-service (DoS) attack in the `django.utils.html.strip_tags()` method. The vulnerability occurs when the `strip_tags()` method or the `striptags` template filter processes inputs containing large sequences of nested, incomplete HTML entities.

Affected versions of the Django package are vulnerable to Denial of Service (DoS) due to quadratic time complexity during HTML parsing in text truncation methods. The django.utils.text.Truncator.chars() and Truncator.words() methods (with html=True), as well as the truncatechars_html and truncatewords_html template filters, exhibit quadratic time complexity when processing inputs containing a large number of unmatched HTML end tags.

Affected versions of Django are potentially vulnerable to denial-of-service via the get_supported_language_variant() method. This method was susceptible to a denial-of-service attack when used with very long strings containing specific characters. Exploiting this vulnerability could cause significant delays or crashes in the affected application, potentially leading to service disruption.

Affected versions of Django are vulnerable to potential regular expression denial-of-service (REDoS). django.utils.text.Truncator.words() method (with html=True) and truncatewords_html template filter were subject to a potential regular expression denial-of-service attack using a suitably crafted string (follow up to CVE-2019-14232 and CVE-2023-43665).

Affected versions of Django are affected by a username enumeration vulnerability caused by timing differences in the django.contrib.auth.backends.ModelBackend.authenticate() method. This method allowed remote attackers to enumerate users through a timing attack involving login requests for users with unusable passwords. The timing difference in the authentication process exposed whether a username was valid or not, potentially aiding attackers in gaining unauthorized access.

Affected versions of the Django package are vulnerable to Denial of Service due to uncontrolled resource consumption during URL parsing on Windows. The URLField.to_python() method invokes urllib.parse.urlsplit(), which performs NFKC normalisation on Windows that is disproportionately slow for certain Unicode characters. A remote attacker can submit large URL inputs containing these characters to forms backed by URLField, causing excessive CPU consumption and rendering the service unavailable.

A security vulnerability has been discovered in certain versions of Django, affecting the password reset functionality. The PasswordResetForm class in django.contrib.auth.forms inadvertently allowed attackers to enumerate user email addresses by exploiting unhandled exceptions during the email sending process. This could be done by issuing password reset requests and observing the responses. Django has implemented a fix where these exceptions are now caught and logged using the django.contrib.auth logger, preventing potential information leakage through error responses.

Affected versions of Django are vulnerable to a potential denial-of-service attack due to improper IPv6 validation. The lack of upper limit enforcement for input strings in clean_ipv6_address, is_valid_ipv6_address, and the django.forms.GenericIPAddressField form field allowed attackers to exploit overly long inputs, causing resource exhaustion. The vulnerability is addressed by defining a max_length of 39 characters for affected form fields. The django.db.models.GenericIPAddressField model field was not impacted. Users should upgrade promptly.

Affected versions of Django are vulnerable to potential Denial of Service via certain inputs with a very large number of Unicode characters in django.utils.encoding.uri_to_iri().

Django affected versions are vulnerable to a potential SQL injection in the HasKey(lhs, rhs) lookup on Oracle databases. The vulnerability arises when untrusted data is directly used as the lhs value in the django.db.models.fields.json.HasKey lookup. However, applications using the jsonfield.has_key lookup with the __ syntax remain unaffected by this issue.

Django has a potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget. The urlize and urlizetrunc functions, along with AdminURLFieldWidget, are vulnerable to denial-of-service attacks when handling inputs with a very large number of Unicode characters.

Django addresses a memory exhaustion issue in django.utils.numberformat.floatformat(). When floatformat receives a string representation of a number in scientific notation with a large exponent, it could lead to excessive memory consumption. To prevent this, decimals with more than 200 digits are now returned as-is.

Affected versions of Django are vulnerable to a potential denial-of-service in django.utils.text.wrap(). The django.utils.text.wrap() and wordwrap template filter were subject to a potential denial-of-service attack when used with very long strings.

Affected versions of the Django package are vulnerable to SQL Injection due to improper handling of control characters in column aliases within FilteredRelation. The FilteredRelation class fails to properly sanitize column aliases containing control characters when used with QuerySet methods annotate(), aggregate(), extra(), values(), values_list(), and alias() via dictionary expansion (**kwargs).

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Affected versions of the Django package are vulnerable to Denial of Service due to uncontrolled memory consumption in the floatformat template filter. The floatformat filter fails to handle string representations of numbers in scientific notation with large exponents efficiently, causing excessive memory allocation when rendering such inputs. An attacker can exploit this by supplying a template with a floatformat filter applied to a specially crafted scientific notation number, leading to memory exhaustion and service unavailability.

Affected versions of Django are affected by a potential denial-of-service vulnerability in the django.utils.html.urlize() function. The urlize and urlizetrunc template filters were susceptible to a denial-of-service attack via certain inputs containing many brackets. An attacker could exploit this vulnerability to cause significant delays or crashes in the affected application.

Affected versions of Django has a potential SQL injection vulnerability in the QuerySet.values() and QuerySet.values_list() methods. When used on models with a JSONField, these methods are susceptible to SQL injection through column aliases if a crafted JSON object key is passed as an argument.

Affected versions of Django are vulnerable to potential denial-of-service in intcomma template filter when used with very long strings.

Affected versions of the Django package are vulnerable to Information Disclosure (Timing Attack) due to non-constant-time comparison in the mod_wsgi authentication handler. The django.contrib.auth.handlers.modwsgi.check_password() function does not perform user existence checks in constant time, allowing response timing differences to reveal whether usernames exist.

Affected versions of the Django package are vulnerable to SQL Injection due to insufficient input sanitization in FilteredRelation column aliases. The FilteredRelation class fails to properly validate or escape column alias names when they are provided through dictionary expansion as keyword arguments to QuerySet.annotate() or QuerySet.alias() methods, allowing malicious SQL code to be injected directly into the generated database queries.

Affected versions of the Django package are vulnerable to SQL Injection due to insufficient neutralization of user-controlled column alias names provided via dictionary expansion. The QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() methods accept **kwargs whose keys are used as column aliases, and on MySQL and MariaDB, those identifiers are not safely quoted, permitting crafted input to be incorporated into the generated SQL.

Affected versions of the Django package are vulnerable to Denial of Service due to unbounded request-body allocation when reading HttpRequest.body for ASGI requests whose Content-Length header is missing or understates the actual payload size. The body-reading path relies on the declared Content-Length to enforce the DATA_UPLOAD_MAX_MEMORY_SIZE cap, so an ASGI request that omits Content-Length or advertises a smaller value than the payload being streamed bypasses the limit check and reads the full incoming body into memory. An unauthenticated remote attacker can exploit this against a Django application served over ASGI by sending a request without Content-Length or with an understated value, causing the server to load an arbitrarily large request body into memory and exhaust available resources on the host.

Affected versions of the Django package are vulnerable to Denial of Service due to inefficient algorithmic complexity in MultiPartParser when handling multipart upload parts that declare Content-Transfer-Encoding: base64 and include excessive whitespace. The parser normalises and decodes the base64 body of each part without bounding the volume of interstitial whitespace, so processing time grows disproportionately with the amount of attacker-supplied whitespace embedded in the encoded payload, reaching a pathological worst case under crafted input. An authenticated remote attacker able to submit multipart uploads can exploit this by including large amounts of whitespace inside a base64-encoded part to consume excessive CPU during request parsing, degrading availability of the Django application.

Affected versions of the Django package are vulnerable to Missing Authorization due to GenericInlineModelAdmin failing to validate add permissions on inline model instances when processing forged POST data on admin change forms. When the admin changes view handles inline formsets backed by GenericInlineModelAdmin, new inline rows submitted in the POST payload are persisted without verifying that the requesting user holds add permission on the target inline model, so the add-permission check is effectively skipped for generic inline relationships. An authenticated admin user who holds change permission on a parent model but lacks add permission on an associated generic-inline model can exploit this by submitting crafted POST data containing additional inline rows, creating new instances of the inline model and resulting in unauthorised record creation within the Django admin.

Affected versions of the Django package are vulnerable to Missing Authorization due to the admin changelist view processing forged POST data against a ModelAdmin that defines list_editable without enforcing that submitted rows correspond only to existing records a user is permitted to edit. The changelist form handling is under ModelAdmin.list_editable accepts form entries whose primary key values do not match any existing row and creates new instances from them, treating the inline edit endpoint as an implicit create path that bypasses the add-permission check. An authenticated admin user who holds change permission on a model exposed via list_editable but lacks add permission can exploit this by submitting crafted POST data to the changelist endpoint to create new instances of that model, resulting in unauthorized record creation within the Django admin.

Django fixes potential SQL injection in ``FilteredRelation`` column aliases on PostgreSQL.

Django 4.2.7, 4.1.13 and 3.2.23 include a fix for CVE-2023-46695: Potential denial of service vulnerability in UsernameField on Windows.
https://www.djangoproject.com/weblog/2023/nov/01/security-releases

CVE-2025-64459: Affected versions of the Django package are vulnerable to SQL Injection due to improper input validation, allowing the internal _connector keyword argument to be accepted from untrusted dictionaries via expansion. The .filter(), .exclude(), and .get() methods on QuerySet, as well as the Q class, resolve **kwargs and will treat a supplied _connector value as the logical connector without constraining it to the expected set (AND/OR), permitting attacker-controlled tokens to influence SQL predicate construction.

CVE-2025-64458: Affected versions of the Django package are vulnerable to Denial of Service (DoS) due to slow Unicode NFKC normalization on Windows being applied to untrusted inputs. The django.contrib.auth.views.LoginView and django.contrib.auth.views.LogoutView, and django.views.i18n.set_language normalize user-controlled strings using Python’s NFKC algorithm, which is unusually slow on Windows for huge Unicode sequences and can be triggered to consume excessive CPU.

Affected versions of the Django package are vulnerable to HTTP Header Spoofing due to ambiguous normalisation of request header names in ASGIRequest, where two distinct on-the-wire header variants that differ only in underscore versus hyphen separators collapse to the same internal key. When Django builds the request META mapping for an ASGI request, a header such as X-Forwarded-For and a client-supplied X_Forwarded_For are both mapped to the single underscore form, so an attacker-controlled header can overwrite or masquerade as a trusted header set by a fronting proxy or middleware. An unauthenticated remote attacker can exploit this by sending an HTTP request containing an underscore-separated header name that collides with a trusted hyphenated header to spoof values relied on by downstream middleware or application code, such as forwarded-client or authentication-related headers, leading to authentication bypass and integrity impact.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Gitpython 3.1.33 includes a fix for CVE-2023-40590: Untrusted search path on Windows systems leading to arbitrary code execution.
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

Affected versions of the GitPython package are vulnerable to Command Injection due to the unsafe-option allowlist being bypassed by equivalent Python keyword arguments. While GitPython's check_unsafe_options validator blocks dangerous Git CLI flags such as --upload-pack and --receive-pack by default, the corresponding upload_pack and receive_pack Python kwargs are accepted by Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push() are translated into the same Git invocation without passing through the unsafe-option check defined in git/repo/base.py and git/remote.py. An attacker who can supply attacker-controlled kwargs to these GitPython APIs can therefore specify arbitrary helper-command paths via upload_pack or receive_pack and achieve arbitrary command execution even when allow_unsafe_options is left at its default value of False.

Affected versions of the GitPython package are vulnerable to Argument Injection due to the unsafe-option check being applied to multi_options before the value is transformed by shlex.split. In _clone() at git/repo/base.py line 1383, multi_options is first joined and passed through shlex.split, but check_unsafe_options at line 1390 validates the original list rather than the post-split tokens, so a single element such as '--branch main --config core.hooksPath=/x' passes the prefix check yet expands at line 1392 into separate --config and core.hooksPath tokens that Git honors during clone. An attacker who can influence multi_options can smuggle dangerous Git options past the validator and apply arbitrary configuration directives, such as core.hooksPath, causing Git to execute attacker-controlled hook scripts during the clone operation and achieve arbitrary command execution.

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Affected versions of the GitPython package are vulnerable to Remote Code Execution via Newline Injection due to GitConfigParser.set_value() passing values to Python's configparser without validating for embedded newline characters. GitPython's _write() method converts embedded newlines into indented continuation lines, but Git still accepts an indented [core] stanza as a valid section header, allowing an attacker to inject arbitrary Git configuration directives such as core.hooksPath into .git/config. An attacker who can control values passed to config_writer().set_value() can point core.hooksPath to an attacker-controlled directory, causing any subsequent Git operation that invokes hooks (commit, merge, checkout) to execute arbitrary scripts.

Affected versions of the GitPython package are vulnerable to Remote Code Execution (RCE) due to incomplete input validation in the set_value() method of GitConfigParser. The patch for CVE-2026-42215 validates newline characters only in the value parameter, while the section and option parameters are passed to configparser without any newline sanitisation, allowing injection of arbitrary section headers into .git/config. An attacker who controls the section argument can inject a forged [core] section with a hooksPath directive pointing to an attacker-controlled directory, leading to arbitrary code execution when any git hook is triggered.

Affected versions of the GitPython package are vulnerable to Path Traversal due to insufficient validation of attacker-controlled reference paths before filesystem write, rename, and delete operations. Although SymbolicReference._check_ref_name_valid() rejects traversal sequences, the SymbolicReference.create, Reference.create, SymbolicReference.set_reference, SymbolicReference.rename, and SymbolicReference.delete methods construct filesystem paths from supplied ref names without enforcing the repository boundary. An attacker who can supply a crafted reference name to an application using GitPython can write, overwrite, move, or delete arbitrary files outside the repository's .git directory, resulting in Arbitrary File Write and Arbitrary File Deletion.