https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:54:10.459214+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-14474 bdu:2026-14474 2026-10-02T10:54:10.605464+00:00 bdu:2026-14474 https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-87817 BREW-aider-CVE-2026-87817 — GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution 2026-10-02T10:54:10.605517+00:00

Affected: Homebrew: aider

### Summary

`Repo.__init__` decides which directory is the git directory by testing candidate paths in an order that considers the real `.git` **last**. Two earlier tests can be satisfied by ordinary tracked files. Git reserves only the literal name `.git`, so `HEAD`, `objects/`, `refs/`, `config`, `gitdir`, `commondir` and `hooks/` at a repository root are all legal tracked content.

Consequently, after a victim opens or clones an attacker's repository, GitPython resolves `git_dir` to the **working-tree root** while real git correctly resolves `<root>/.git`. Everything GitPython then treats as "inside the git directory" is attacker-authored content — including `hooks/`, which it executes.

### CVE-2026-87817

### Affected code (3.1.59)

The discovery loop in `git/repo/base.py` tests, in order:

1. `git/repo/base.py:299` — `isfile(curpath/gitdir)` **and** `isfile(curpath/commondir)` **and** `isfile(curpath/HEAD)` 2. `git/repo/base.py:320` — `is_git_dir(curpath)` 3. `git/repo/base.py:341` — `dotgit = osp.join(curpath, ".git")` ← the real git dir, considered last

`is_git_dir` (`git/repo/fun.py:60`) requires only that `objects/` and `refs/` are directories and that `HEAD` is a file; **`HEAD`'s contents are never parsed.** The hook path is resolved from `index.repo.git_dir` (`git/index/fun.py:73`), i.e. the mis-resolved directory.

### Proof of concept

Requires only `pip install GitPython==3.1.59`. Full script attached as `poc1_rce.py`; it runs entirely in a temp directory an…

 https://cve.radiocsirt.org/vuln/euvd-2026-366298 EUVD-2026-366298 2026-10-02T10:54:10.605596+00:00 EUVD-2026-366298 https://cve.radiocsirt.org/vuln/fkie_cve-2026-87817 fkie_cve-2026-87817 2026-10-02T10:54:10.605612+00:00

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.

 https://cve.radiocsirt.org/vuln/ghsa-239g-whfq-7xj9 GHSA-239g-whfq-7xj9 — GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution 2026-10-02T10:54:10.605636+00:00

Affected: PyPI: gitpython

### Summary

`Repo.__init__` decides which directory is the git directory by testing candidate paths in an order that considers the real `.git` **last**. Two earlier tests can be satisfied by ordinary tracked files. Git reserves only the literal name `.git`, so `HEAD`, `objects/`, `refs/`, `config`, `gitdir`, `commondir` and `hooks/` at a repository root are all legal tracked content.

Consequently, after a victim opens or clones an attacker's repository, GitPython resolves `git_dir` to the **working-tree root** while real git correctly resolves `<root>/.git`. Everything GitPython then treats as "inside the git directory" is attacker-authored content — including `hooks/`, which it executes.

### CVE-2026-87817

### Affected code (3.1.59)

The discovery loop in `git/repo/base.py` tests, in order:

1. `git/repo/base.py:299` — `isfile(curpath/gitdir)` **and** `isfile(curpath/commondir)` **and** `isfile(curpath/HEAD)` 2. `git/repo/base.py:320` — `is_git_dir(curpath)` 3. `git/repo/base.py:341` — `dotgit = osp.join(curpath, ".git")` ← the real git dir, considered last

`is_git_dir` (`git/repo/fun.py:60`) requires only that `objects/` and `refs/` are directories and that `HEAD` is a file; **`HEAD`'s contents are never parsed.** The hook path is resolved from `index.repo.git_dir` (`git/index/fun.py:73`), i.e. the mis-resolved directory.

### Proof of concept

Requires only `pip install GitPython==3.1.59`. Full script attached as `poc1_rce.py`; it runs entirely in a temp directory an…

 https://cve.radiocsirt.org/vuln/oesa-2026-4025 OESA-2026-4025 — python-GitPython security update 2026-10-02T10:54:10.605696+00:00

Affected: openEuler:24.03-LTS-SP1: python-GitPython

**GitPython*is a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files support.With the new object database abstraction added in 0.3, its even possible to implement your own storage mechanisms, the currently available implementations are &amp;apos;cgit&amp;apos; and pure python, which is the default.Documentation The latest documentation can be found here: As this version of GitPython depends on GitDB, which in turn needs smmap to work, installation is a bit more involved if you do a manual installation, instead of using pip. Security Fix(es):

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.(CVE-2026-87817)

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-lin…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21874-1 openSUSE-SU-2026:21874-1 — Security update for python-GitPython 2026-10-02T10:54:10.605731+00:00

Security update for python-GitPython

 https://cve.radiocsirt.org/vuln/pysec-2026-3982 PYSEC-2026-3982 2026-10-02T10:54:10.605761+00:00

Affected: PyPI: gitpython

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.

 https://cve.radiocsirt.org/vuln/rhsa-2026:68764 RHSA-2026:68764 — Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image 2026-10-02T10:54:10.605780+00:00

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks GitPython: GitPython: Arbitrary code execution via improper validation of clone options net/mail: golang: net/mail: Denial of Service via pathological email address parsing GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration openssl: openssl-src: OpenSSL: Memory leak leads to Denial of Service in OCSP response checking golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding gitpython: GitPython: Information disclosure via environment variable expansion in URL handling gitpython: GitPython: Remote Code Execution via malicious Git template gitpython: GitPython: Arbitrary File Overwrite via improper git option validation gitpython: GitPython: Remote Code Execution via kwarg value smuggling gitpython: GitPython: Remote Code Execution via malicious Git hooks gitpython: GitPython: Arbitrary File Overwrite via `git read-tree` option injection gitpython: GitPython: Arbitrary command execution via crafted kwargs gitpython: GitPython: Arbitrary code execution via config-name injection gitpython: G…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-87817 UBUNTU-CVE-2026-87817 2026-10-02T10:54:10.605836+00:00

Affected: Ubuntu:Pro:14.04:LTS: python-git, Ubuntu:Pro:16.04:LTS: python-git, Ubuntu:Pro:18.04:LTS: python-git, Ubuntu:Pro:20.04:LTS: python-git, Ubuntu:Pro:22.04:LTS: python-git, Ubuntu:Pro:24.04:LTS: python-git, Ubuntu:Pro:26.04:LTS: python-git

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3555 WID-SEC-W-2026-3555 — Red Hat Ansible Automation Platform (automation-controller): Mehrere Schwachstellen 2026-10-02T10:54:10.605866+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.