PatchTheCEVgitpython vulnerabilities and fixes
Recent CVEs affecting gitpython, with upgrade or downgrade steps. 14 tracked.
gitpython has 14 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 14. Most recent: 2026-08-19. Highest priority: CVE-2026-67324 (score 60/100).
- CVE-2026-67324 CRITICAL 9.8 UPGRADE GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pa
- CVE-2026-67325 HIGH 8.8 UPGRADE GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's lon
- CVE-2026-67323 HIGH 8.4 UPGRADE GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archi
- CVE-2026-76221 HIGH 8.8 UPGRADE GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allow
- CVE-2026-67322 HIGH 7.5 UPGRADE GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from()
- CVE-2026-67326 HIGH 7.0 UPGRADE GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allo
- CVE-2026-69097 HIGH 7.0 UPGRADE GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inje
- CVE-2026-73625 HIGH 8.8 UPGRADE GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options gua
- CVE-2026-73622 HIGH 7.5 UPGRADE GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add()
- CVE-2026-73623 HIGH 7.5 UPGRADE GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, all
- CVE-2026-73620 HIGH 8.1 UPGRADE GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create()
- CVE-2026-73624 HIGH 8.1 UPGRADE GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method
- CVE-2026-73619 MEDIUM 6.5 UPGRADE GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --a
- CVE-2026-73621 MEDIUM 5.4 UPGRADE GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwa
FAQ
How do I fix gitpython vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is gitpython being exploited right now?
None of the tracked gitpython CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which gitpython CVE should I patch first?
CVE-2026-67324 currently ranks highest (60/100): GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pa.