https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 17:24:07 +0000 https://db.gcve.eu/vuln/cve-2026-110859 <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=&lt;path&gt;, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.</p> <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=&lt;path&gt;, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.</p> https://db.gcve.eu/vuln/cve-2026-110859 https://db.gcve.eu/vuln/ghsa-23mf-xhv8-69c2 <p><strong>Affected:</strong> PyPI: GitPython</p> <p>&gt; **A note on the referenced files.** This report was submitted through GitHub&#39;s private &gt; vulnerability reporting API, which carries no attachments. Every transcript this report leans &gt; on is reproduced **inline above**, verbatim. The file names it mentions (`poc.sh`, `poc.log`, &gt; per-case transcripts, `evidence.md`, `negative-controls.md`, blob-sweep tables) are the local &gt; evidence bundle those inline excerpts were extracted from, with a checksum manifest. I am happy &gt; to send the bundle by any channel you prefer, or to open a private fork — just say which. The &gt; PoC scripts are self-contained and reproduce the result from a clean environment.</p> <p>---</p> <p>**Affected:** `&lt;= 3.1.62` — all published releases; also `main` @ `4905b4af` **Verified at runtime:** GitPython `3.1.62` with git `2.55.0` **Date:** 2026-09-10 **Reporter:** MAXI8594</p> <p>---</p> <p>## Threat model</p> <p>| | | |---|---| | **Attacker** | anyone who can get the application to clone a URL they control. No account, no credential, no privilege in the consuming application. | | **Pre-need** | a repository they host, with `HEAD` pointing at a branch whose name is the payload. A `git push` to a plain git server is enough — no filesystem access to a server is required (`raw/06`). | | **Gets** | the contents of any file the application&#39;s process can read, returned in band through the exception. `/etc/passwd` recovered 34 of 34 lines. | | **Real-world likelihood** | **High.** The vulnerable consumer is six lines of ordinary code with n…</p> <p><strong>Affected:</strong> PyPI: GitPython</p> <p>&gt; **A note on the referenced files.** This report was submitted through GitHub&#39;s private &gt; vulnerability reporting API, which carries no attachments. Every transcript this report leans &gt; on is reproduced **inline above**, verbatim. The file names it mentions (`poc.sh`, `poc.log`, &gt; per-case transcripts, `evidence.md`, `negative-controls.md`, blob-sweep tables) are the local &gt; evidence bundle those inline excerpts were extracted from, with a checksum manifest. I am happy &gt; to send the bundle by any channel you prefer, or to open a private fork — just say which. The &gt; PoC scripts are self-contained and reproduce the result from a clean environment.</p> <p>---</p> <p>**Affected:** `&lt;= 3.1.62` — all published releases; also `main` @ `4905b4af` **Verified at runtime:** GitPython `3.1.62` with git `2.55.0` **Date:** 2026-09-10 **Reporter:** MAXI8594</p> <p>---</p> <p>## Threat model</p> <p>| | | |---|---| | **Attacker** | anyone who can get the application to clone a URL they control. No account, no credential, no privilege in the consuming application. | | **Pre-need** | a repository they host, with `HEAD` pointing at a branch whose name is the payload. A `git push` to a plain git server is enough — no filesystem access to a server is required (`raw/06`). | | **Gets** | the contents of any file the application&#39;s process can read, returned in band through the exception. `/etc/passwd` recovered 34 of 34 lines. | | **Real-world likelihood** | **High.** The vulnerable consumer is six lines of ordinary code with n…</p> https://db.gcve.eu/vuln/ghsa-23mf-xhv8-69c2