Git vulnerabilities and fixes

CVEs that mention Git, ranked by priority. 50 tracked.

Git has 50 tracked vulnerabilities, 7 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 40. Most recent: 2026-10-23. Highest priority: CVE-2026-60004 (score 97/100).

• CVE-2026-60004 CRITICAL 9.8 EXPLOITED UPGRADE Gitea Code Injection Vulnerability
• CVE-2026-73240 CRITICAL 9.8 UPGRADE Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Al
• CVE-2026-67324 CRITICAL 9.8 UPGRADE GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pa
• CVE-2026-67325 HIGH 8.8 UPGRADE GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's lon
• CVE-2026-67323 HIGH 8.4 UPGRADE GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archi
• CVE-2026-17556 CRITICAL 9.1 UPGRADE A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated atta
• CVE-2026-70375 HIGH 8.8 HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer compon
• CVE-2026-73625 HIGH 8.8 UPGRADE GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options gua
• CVE-2026-73294 CRITICAL 9.9 Semaphore UI is a web interface for managing DevOps tools
• CVE-2026-76221 HIGH 8.8 UPGRADE GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allow
• CVE-2026-67623 HIGH 8.8 Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arb
• CVE-2026-73622 HIGH 7.5 UPGRADE GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add()
• CVE-2026-56748 HIGH 8.8 UPGRADE Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a re
• CVE-2026-72538 HIGH 8.8 An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve r
• CVE-2026-73623 HIGH 7.5 UPGRADE GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, all
• CVE-2026-75913 CRITICAL 9.3 CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerabil
• CVE-2026-64665 HIGH 8.1 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-65907 CRITICAL 9.1 In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
• CVE-2026-72767 HIGH 8.8 UPGRADE n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability
• CVE-2026-73620 HIGH 8.1 UPGRADE GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create()
• CVE-2026-73624 HIGH 8.1 UPGRADE GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method
• CVE-2026-19266 MEDIUM 5.5 A vulnerability was determined in Kirachon context-engine up to 1.9.0
• CVE-2026-62200 HIGH 8.8 UPGRADE OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext t
• CVE-2026-67322 HIGH 7.5 UPGRADE GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from()
• CVE-2026-53455 HIGH 8.6 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-106764 HIGH 7.5 An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseB
• CVE-2026-62999 HIGH 7.5 Copier is a library and CLI app for rendering project templates
• CVE-2026-75912 HIGH 7.4 CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows
• CVE-2026-71539 HIGH 8.9 n8n is an open source workflow automation platform
• CVE-2026-73122 HIGH 7.7 A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM)
• CVE-2026-64663 MEDIUM 6.5 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-72770 MEDIUM 6.5 UPGRADE n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-ta
• CVE-2026-73619 MEDIUM 6.5 UPGRADE GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --a
• CVE-2026-16629 MEDIUM 5.3 A vulnerability was identified in danger danger-js up to 13.0.7
• CVE-2026-53454 MEDIUM 6.9 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-67326 HIGH 7.0 UPGRADE GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allo
• CVE-2026-69097 HIGH 7.0 UPGRADE GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inje
• CVE-2026-71434 MEDIUM 5.3 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-114145 HIGH 7.5 GitPython is a python library used to interact with Git repositories
• CVE-2026-57208 MEDIUM 6.2 Entire CLI hooks into Git workflows to capture AI agent sessions
• CVE-2026-64662 MEDIUM 6.5 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-73621 MEDIUM 5.4 UPGRADE GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwa
• CVE-2026-114097 HIGH 7.8 Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter()
• CVE-2026-71435 MEDIUM 6.1 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-72718 HIGH 7.0 goose is general-purpose AI agent that runs on your machine
• CVE-2026-113354 MEDIUM 6.5 Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:e
• CVE-2026-73506 MEDIUM 6.1 Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer
• CVE-2026-75057 MEDIUM 6.2 UPGRADE In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
• CVE-2026-64664 MEDIUM 4.3 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-12565 MEDIUM 5.3 The unarchive internal module's archive extraction commands perform no code-level validation on extracted file

FAQ

How do I fix Git vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Git being exploited right now?

Yes: 1 Git CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which Git CVE should I patch first?

CVE-2026-60004 currently ranks highest (97/100): Gitea Code Injection Vulnerability.

← Back to latest CVEs