https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:48:13 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10824 bdu:2026-10824 https://cve.radiocsirt.org/vuln/bdu:2026-10824 https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-42284 <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary</p> <p>`_clone()` validates `multi_options` as the original list, then executes `shlex.split(&#34; &#34;.join(multi_options))`. A string like `&#34;--branch main --config core.hooksPath=/x&#34;` passes validation (starts with `--branch`), but after split becomes `[&#34;--branch&#34;, &#34;main&#34;, &#34;--config&#34;, &#34;core.hooksPath=/x&#34;]`. Git applies the config and executes attacker hooks during clone.</p> <p>### Details</p> <p>The vulnerable code is in [`git/repo/base.py` line 1383](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1383): ```python multi = shlex.split(&#34; &#34;.join(multi_options)) ```</p> <p>Then validation runs on the **original** list at [line 1390](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1390): ```python Git.check_unsafe_options(options=multi_options, unsafe_options=cls.unsafe_git_clone_options) ```</p> <p>Then execution uses the **transformed** result at [line 1392](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1392): ```python proc = git.clone(multi, &#34;--&#34;, url, path, ...) ```</p> <p>The [check at `git/cmd.py` line 959](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/cmd.py#L959) uses `startswith`: ```python if option.startswith(unsafe_option) or option == bare_option: ```</p> <p>`&#34;--branch main --config ...&#34;` does not start with `&#34;--config&#34;`, so it passes. After `shlex.…</p> <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary</p> <p>`_clone()` validates `multi_options` as the original list, then executes `shlex.split(&#34; &#34;.join(multi_options))`. A string like `&#34;--branch main --config core.hooksPath=/x&#34;` passes validation (starts with `--branch`), but after split becomes `[&#34;--branch&#34;, &#34;main&#34;, &#34;--config&#34;, &#34;core.hooksPath=/x&#34;]`. Git applies the config and executes attacker hooks during clone.</p> <p>### Details</p> <p>The vulnerable code is in [`git/repo/base.py` line 1383](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1383): ```python multi = shlex.split(&#34; &#34;.join(multi_options)) ```</p> <p>Then validation runs on the **original** list at [line 1390](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1390): ```python Git.check_unsafe_options(options=multi_options, unsafe_options=cls.unsafe_git_clone_options) ```</p> <p>Then execution uses the **transformed** result at [line 1392](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1392): ```python proc = git.clone(multi, &#34;--&#34;, url, path, ...) ```</p> <p>The [check at `git/cmd.py` line 959](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/cmd.py#L959) uses `startswith`: ```python if option.startswith(unsafe_option) or option == bare_option: ```</p> <p>`&#34;--branch main --config ...&#34;` does not start with `&#34;--config&#34;`, so it passes. After `shlex.…</p> https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-42284 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1056 certfr-2026-avi-1056 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1056 https://cve.radiocsirt.org/vuln/euvd-2026-309309 EUVD-2026-309309 https://cve.radiocsirt.org/vuln/euvd-2026-309309 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42284 <p>GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(&#34; &#34;.join(multi_options)). A string like &#34;--branch main --config core.hooksPath=/x&#34; passes validation (starts with --branch), but after split becomes [&#34;--branch&#34;, &#34;main&#34;, &#34;--config&#34;, &#34;core.hooksPath=/x&#34;]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.</p> <p>GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(&#34; &#34;.join(multi_options)). A string like &#34;--branch main --config core.hooksPath=/x&#34; passes validation (starts with --branch), but after split becomes [&#34;--branch&#34;, &#34;main&#34;, &#34;--config&#34;, &#34;core.hooksPath=/x&#34;]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42284 https://cve.radiocsirt.org/vuln/ghsa-x2qx-6953-8485 <p><strong>Affected:</strong> PyPI: GitPython</p> <p>### Summary</p> <p>`_clone()` validates `multi_options` as the original list, then executes `shlex.split(&#34; &#34;.join(multi_options))`. A string like `&#34;--branch main --config core.hooksPath=/x&#34;` passes validation (starts with `--branch`), but after split becomes `[&#34;--branch&#34;, &#34;main&#34;, &#34;--config&#34;, &#34;core.hooksPath=/x&#34;]`. Git applies the config and executes attacker hooks during clone.</p> <p>### Details</p> <p>The vulnerable code is in [`git/repo/base.py` line 1383](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1383): ```python multi = shlex.split(&#34; &#34;.join(multi_options)) ```</p> <p>Then validation runs on the **original** list at [line 1390](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1390): ```python Git.check_unsafe_options(options=multi_options, unsafe_options=cls.unsafe_git_clone_options) ```</p> <p>Then execution uses the **transformed** result at [line 1392](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1392): ```python proc = git.clone(multi, &#34;--&#34;, url, path, ...) ```</p> <p>The [check at `git/cmd.py` line 959](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/cmd.py#L959) uses `startswith`: ```python if option.startswith(unsafe_option) or option == bare_option: ```</p> <p>`&#34;--branch main --config ...&#34;` does not start with `&#34;--config&#34;`, so it passes. After `shlex.…</p> <p><strong>Affected:</strong> PyPI: GitPython</p> <p>### Summary</p> <p>`_clone()` validates `multi_options` as the original list, then executes `shlex.split(&#34; &#34;.join(multi_options))`. A string like `&#34;--branch main --config core.hooksPath=/x&#34;` passes validation (starts with `--branch`), but after split becomes `[&#34;--branch&#34;, &#34;main&#34;, &#34;--config&#34;, &#34;core.hooksPath=/x&#34;]`. Git applies the config and executes attacker hooks during clone.</p> <p>### Details</p> <p>The vulnerable code is in [`git/repo/base.py` line 1383](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1383): ```python multi = shlex.split(&#34; &#34;.join(multi_options)) ```</p> <p>Then validation runs on the **original** list at [line 1390](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1390): ```python Git.check_unsafe_options(options=multi_options, unsafe_options=cls.unsafe_git_clone_options) ```</p> <p>Then execution uses the **transformed** result at [line 1392](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1392): ```python proc = git.clone(multi, &#34;--&#34;, url, path, ...) ```</p> <p>The [check at `git/cmd.py` line 959](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/cmd.py#L959) uses `startswith`: ```python if option.startswith(unsafe_option) or option == bare_option: ```</p> <p>`&#34;--branch main --config ...&#34;` does not start with `&#34;--config&#34;`, so it passes. After `shlex.…</p> https://cve.radiocsirt.org/vuln/ghsa-x2qx-6953-8485 https://cve.radiocsirt.org/vuln/opensuse-su-2026:20777-1 <p>Security update for python-GitPython</p> <p>Security update for python-GitPython</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:20777-1 https://cve.radiocsirt.org/vuln/pysec-2026-2161 <p><strong>Affected:</strong> PyPI: gitpython</p> <p>GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(&#34; &#34;.join(multi_options)). A string like &#34;--branch main --config core.hooksPath=/x&#34; passes validation (starts with --branch), but after split becomes [&#34;--branch&#34;, &#34;main&#34;, &#34;--config&#34;, &#34;core.hooksPath=/x&#34;]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.</p> <p><strong>Affected:</strong> PyPI: gitpython</p> <p>GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(&#34; &#34;.join(multi_options)). A string like &#34;--branch main --config core.hooksPath=/x&#34; passes validation (starts with --branch), but after split becomes [&#34;--branch&#34;, &#34;main&#34;, &#34;--config&#34;, &#34;core.hooksPath=/x&#34;]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2161 https://cve.radiocsirt.org/vuln/rhsa-2026:42078 <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handling python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks GitPython: GitPython: Arbitrary code execution via improper validation of clone options GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration…</p> <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handling python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks GitPython: GitPython: Arbitrary code execution via improper validation of clone options GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:42078 https://cve.radiocsirt.org/vuln/suse-su-2026:21813-1 <p>Security update for python-GitPython</p> <p>Security update for python-GitPython</p> https://cve.radiocsirt.org/vuln/suse-su-2026:21813-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42284 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: python-git, Ubuntu:Pro:22.04:LTS: python-git, Ubuntu:Pro:24.04:LTS: python-git, Ubuntu:25.10: python-git, Ubuntu:Pro:26.04:LTS: python-git</p> <p>GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(&#34; &#34;.join(multi_options)). A string like &#34;--branch main --config core.hooksPath=/x&#34; passes validation (starts with --branch), but after split becomes [&#34;--branch&#34;, &#34;main&#34;, &#34;--config&#34;, &#34;core.hooksPath=/x&#34;]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: python-git, Ubuntu:Pro:22.04:LTS: python-git, Ubuntu:Pro:24.04:LTS: python-git, Ubuntu:25.10: python-git, Ubuntu:Pro:26.04:LTS: python-git</p> <p>GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(&#34; &#34;.join(multi_options)). A string like &#34;--branch main --config core.hooksPath=/x&#34; passes validation (starts with --branch), but after split becomes [&#34;--branch&#34;, &#34;main&#34;, &#34;--config&#34;, &#34;core.hooksPath=/x&#34;]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42284 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2933 <p>Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2933