Source: python-git Version: 3.1.50-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for python-git. CVE-2026-76217[0]: | GitPython versions before 3.1.58 fail to validate options passed to | git rm and git checkout commands in IndexFile.remove() and | Head.checkout(). Attackers can supply --pathspec-from-file and | --pathspec-file-nul parameters to read arbitrary files accessible to | the process, with full file contents returned in | GitCommandError.stderr. CVE-2026-76218[1]: | GitPython before 3.1.58 contains a remote code execution | vulnerability in Repo.init that forwards unsafe git options without | validation. Attackers can supply a template parameter pointing to a | directory with malicious git hooks that execute arbitrary code when | git operations are performed on the initialized repository. CVE-2026-76219[2]: | GitPython versions before 3.1.58 contain an arbitrary file overwrite | vulnerability in IndexFile.from_tree, IndexFile.reset, and | IndexFile.merge_tree methods that append caller-influenced treeish | strings to git read-tree without option validation or argument | separation. Attackers can inject the --index-output option to | overwrite arbitrary files with a valid git-index blob, destroying | existing file content at attacker-controlled writable paths. CVE-2026-76220[3]: | GitPython before 3.1.58 contains a command execution vulnerability | in the check_unsafe_options guard that can be bypassed by combining | a single-character kwarg with split_single_char_options=False. | Attackers can supply a crafted kwargs dictionary to guarded methods | like clone_from to emit a joined token parsed as --upload-pack, | enabling arbitrary OS command execution at default | allow_unsafe_options=False. CVE-2026-76221[4]: | GitPython before 3.1.58 contains a config-name injection | vulnerability in the option-name validator that allows attackers to | forge arbitrary git-config directives by injecting equals signs, | hash symbols, and whitespace into option names. Attackers can inject | malicious option names like 'sshCommand = touch /tmp/RCE #' to | execute arbitrary commands via core.sshCommand or core.hooksPath on | the next git operation. CVE-2026-76222[5]: | GitPython before 3.1.58 fails to validate submodule names from | .gitmodules files, allowing attackers to create Git repositories at | arbitrary filesystem paths outside the intended clone directory. | Attackers can craft malicious repositories with traversal sequences | in submodule names that GitPython processes during submodule | initialization, creating attacker-controlled Git repositories at | escaped filesystem locations. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-76217 https://www.cve.org/CVERecord?id=CVE-2026-76217 [1] https://security-tracker.debian.org/tracker/CVE-2026-76218 https://www.cve.org/CVERecord?id=CVE-2026-76218 [2] https://security-tracker.debian.org/tracker/CVE-2026-76219 https://www.cve.org/CVERecord?id=CVE-2026-76219 [3] https://security-tracker.debian.org/tracker/CVE-2026-76220 https://www.cve.org/CVERecord?id=CVE-2026-76220 [4] https://security-tracker.debian.org/tracker/CVE-2026-76221 https://www.cve.org/CVERecord?id=CVE-2026-76221 [5] https://security-tracker.debian.org/tracker/CVE-2026-76222 https://www.cve.org/CVERecord?id=CVE-2026-76222 Regards, Salvatore
