CVE-2026-44244

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level.

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.

GitPython is a Python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability allowed attackers to manipulate files outside the repository's .git directory due to insufficient validation of reference paths.

GitPython is a Python library used to interact with Git repositories. In versions prior to 3.1.47, the _clone() function improperly validates multi_options, allowing malicious hooks to be executed during repository cloning.

GitPython is a Python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, the library blocks dangerous Git options, but equivalent Python kwargs can bypass that check, leading to arbitrary command execution.

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, potentially turning dormant quoted values into active directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live after any GitPython config write, enabling arbitrary code execution.

GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. This issue exists because of an incomplete fix for CVE-2022-24439.

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbitrary files, with contents returned in the annotated tag message.