RHSA-2026:68776
Vulnerability from csaf_redhat - Published: 2026-09-17 20:53 - Updated: 2026-09-24 06:10Summary
Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
Severity
Critical
Notes
Topic: A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.
Details: Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments (kwargs) to functions such as Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(). This bypasses existing security checks designed to block dangerous Git options, enabling the execution of unauthorized commands.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the `_clone()` function. By crafting a malicious string in the `multi_options` parameter, an attacker could bypass validation. This allows for the injection of arbitrary Git configurations, such as `core.hooksPath`, leading to the execution of attacker-controlled hooks and ultimately, arbitrary code execution during a clone operation.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Important
A flaw was found in GitPython, a Python library used to interact with Git repositories. The `GitConfigParser.set_value()` function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the `core.hooksPath`, into a Git repository. Consequently, any Git operation that triggers hooks, such as committing or merging, could lead to arbitrary code execution from an attacker-controlled path.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the `IndexFile.checkout()` and `TagReference.create()` functions. An authenticated attacker can exploit this by passing unsafe options through keyword arguments, leading to the ability to overwrite arbitrary files with repository content or read sensitive files. This could result in significant data integrity and confidentiality impacts.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted to attacker-controlled hosts, leading to information disclosure.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Important
A flaw was found in GitPython. An incomplete denylist in the `unsafe_git_clone_options` function fails to restrict the `--template` option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability allows a remote attacker to overwrite arbitrary files on the system. By failing to properly validate git options passed to the `Diffable.diff` method, an attacker can supply a malicious output argument to write patch content to attacker-controlled file paths, leading to potential system compromise.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Important
A flaw was found in GitPython. Attackers can bypass the `check_unsafe_options` guard by smuggling git options within single-character keyword argument (kwarg) values. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as `clone_from` or `fetch`, leading to arbitrary code execution.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the `Repo.init` function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on the initialized repository, these hooks execute arbitrary code, leading to a complete compromise of the affected system.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the `git read-tree` command through methods like `IndexFile.from_tree`, `IndexFile.reset`, and `IndexFile.merge_tree`, without proper option validation or argument separation, an attacker can cause the application to write a git-index blob to any attacker-controlled writable path, leading to data destruction.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Important
A flaw was found in GitPython. A remote attacker can bypass the `check_unsafe_options` guard by combining a single-character keyword argument with `split_single_char_options=False`. This allows the attacker to supply a crafted dictionary of keyword arguments to guarded methods, such as `clone_from`, leading to arbitrary operating system command execution.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability allows attackers to inject malicious configuration options by manipulating option names within the option-name validator. By injecting special characters, an attacker can forge arbitrary git-config directives, potentially leading to arbitrary code execution on the system when a git operation is performed.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Important
A flaw was found in GitPython where it fails to properly validate submodule names within .gitmodules files. A remote attacker could craft a malicious Git repository containing specially formed submodule names with directory traversal sequences. When GitPython processes these malicious submodule names during repository initialization, it could lead to the creation of attacker-controlled Git repositories at arbitrary locations on the filesystem, potentially impacting system integrity.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Important
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
9.8 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-42215
Threats
Impact
Critical
References
105 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services. ",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:68776",
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42215",
"url": "https://access.redhat.com/security/cve/CVE-2026-42215"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42284",
"url": "https://access.redhat.com/security/cve/CVE-2026-42284"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44244",
"url": "https://access.redhat.com/security/cve/CVE-2026-44244"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73620",
"url": "https://access.redhat.com/security/cve/CVE-2026-73620"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73622",
"url": "https://access.redhat.com/security/cve/CVE-2026-73622"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73623",
"url": "https://access.redhat.com/security/cve/CVE-2026-73623"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73624",
"url": "https://access.redhat.com/security/cve/CVE-2026-73624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73625",
"url": "https://access.redhat.com/security/cve/CVE-2026-73625"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-76218",
"url": "https://access.redhat.com/security/cve/CVE-2026-76218"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-76219",
"url": "https://access.redhat.com/security/cve/CVE-2026-76219"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-76220",
"url": "https://access.redhat.com/security/cve/CVE-2026-76220"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-76221",
"url": "https://access.redhat.com/security/cve/CVE-2026-76221"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-76222",
"url": "https://access.redhat.com/security/cve/CVE-2026-76222"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-78676",
"url": "https://access.redhat.com/security/cve/CVE-2026-78676"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://catalog.redhat.com/software/containers/search",
"url": "https://catalog.redhat.com/software/containers/search"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68776.json"
}
],
"title": "Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview",
"tracking": {
"current_release_date": "2026-09-24T06:10:12+00:00",
"generator": {
"date": "2026-09-24T06:10:12+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:68776",
"initial_release_date": "2026-09-17T20:53:11+00:00",
"revision_history": [
{
"date": "2026-09-17T20:53:11+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-17T20:53:12+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-24T06:10:12+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.19",
"product": {
"name": "Red Hat Satellite 6.19",
"product_id": "Red Hat Satellite 6.19",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.19::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64",
"product": {
"name": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64",
"product_id": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64",
"product_identification_helper": {
"purl": "pkg:oci/iop-vulnerability-engine-rhel9@sha256%3A24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-vulnerability-engine-rhel9\u0026tag=1789607605"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64 as a component of Red Hat Satellite 6.19",
"product_id": "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
},
"product_reference": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64",
"relates_to_product_reference": "Red Hat Satellite 6.19"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-42215",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-05-07T19:01:30.789237+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467802"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments (kwargs) to functions such as Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(). This bypasses existing security checks designed to block dangerous Git options, enabling the execution of unauthorized commands.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important arbitrary command execution flaw in GitPython, a library utilized across several Red Hat products. The vulnerability arises from an incomplete security check that allows specially crafted Python keyword arguments, such as `upload_pack` or `receive_pack`, to bypass intended safeguards against dangerous Git options. This bypass enables an attacker to execute arbitrary commands on systems where applications process untrusted input through GitPython\u0027s repository interaction functions, potentially leading to system compromise, credential theft, or unauthorized data modification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42215"
},
{
"category": "external",
"summary": "RHBZ#2467802",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467802"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42215",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42215"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42215",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42215"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47",
"url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4"
}
],
"release_date": "2026-05-07T18:17:03.194000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks"
},
{
"cve": "CVE-2026-42284",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-05-07T19:01:23.592356+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467800"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the `_clone()` function. By crafting a malicious string in the `multi_options` parameter, an attacker could bypass validation. This allows for the injection of arbitrary Git configurations, such as `core.hooksPath`, leading to the execution of attacker-controlled hooks and ultimately, arbitrary code execution during a clone operation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "GitPython: GitPython: Arbitrary code execution via improper validation of clone options",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in GitPython allows for arbitrary code execution during Git clone operations within Red Hat products that utilize the library. The flaw stems from insufficient validation of user-supplied input to the `_clone()` function, enabling an attacker to inject malicious Git configurations, such as `core.hooksPath`, and execute arbitrary code. Exploitation requires an application to process untrusted input through GitPython\u0027s cloning functionalities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42284"
},
{
"category": "external",
"summary": "RHBZ#2467800",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467800"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42284"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42284",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42284"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47",
"url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485"
}
],
"release_date": "2026-05-07T18:19:20.129000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "GitPython: GitPython: Arbitrary code execution via improper validation of clone options"
},
{
"cve": "CVE-2026-44244",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-05-07T19:01:36.732863+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467804"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython, a Python library used to interact with Git repositories. The `GitConfigParser.set_value()` function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the `core.hooksPath`, into a Git repository. Consequently, any Git operation that triggers hooks, such as committing or merging, could lead to arbitrary code execution from an attacker-controlled path.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in GitPython that allows for arbitrary code execution. By injecting newlines into Git configuration values, an attacker can manipulate the `core.hooksPath` to execute malicious scripts during standard Git operations. This poses a significant risk in environments where applications process unvalidated user input when interacting with Git repositories, potentially leading to persistent repository configuration poisoning.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44244"
},
{
"category": "external",
"summary": "RHBZ#2467804",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467804"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44244"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44244",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44244"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49",
"url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67"
}
],
"release_date": "2026-05-07T18:22:39.704000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications that use GitPython and process untrusted input for Git configuration values must implement robust input validation and sanitization. This prevents the injection of newlines that could manipulate `core.hooksPath` and lead to arbitrary code execution. Additionally, ensure that applications interacting with Git repositories operate with the principle of least privilege to limit the potential impact of any successful exploitation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration"
},
{
"cve": "CVE-2026-73620",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-08-13T11:53:07.982354+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515261"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the `IndexFile.checkout()` and `TagReference.create()` functions. An authenticated attacker can exploit this by passing unsafe options through keyword arguments, leading to the ability to overwrite arbitrary files with repository content or read sensitive files. This could result in significant data integrity and confidentiality impacts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in GitPython that allows an authenticated attacker to achieve arbitrary file overwrite and read capabilities. The vulnerability stems from insufficient validation of git options passed to `IndexFile.checkout()` and `TagReference.create()`, enabling attackers to manipulate repository content or access sensitive files. This impacts several Red Hat products, including Red Hat OpenStack Platform, Red Hat Satellite, and Red Hat Ansible Automation Platform.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73620"
},
{
"category": "external",
"summary": "RHBZ#2515261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515261"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73620"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73620",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73620"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read",
"url": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read"
}
],
"release_date": "2026-08-13T11:28:21.426000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding"
},
{
"cve": "CVE-2026-73622",
"cwe": {
"id": "CWE-914",
"name": "Improper Control of Dynamically-Identified Variables"
},
"discovery_date": "2026-08-13T11:54:21.696489+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515269"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted to attacker-controlled hosts, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Information disclosure via environment variable expansion in URL handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in GitPython. It allows an attacker to exfiltrate sensitive environment variables from systems that use GitPython to create or add remote repositories from untrusted URLs. This occurs because environment variable expansion is not disabled in URL handling, leading to secrets being embedded in Git configuration and transmitted to attacker-controlled hosts.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73622"
},
{
"category": "external",
"summary": "RHBZ#2515269",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515269"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73622",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73622"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73622",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73622"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2",
"url": "https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add",
"url": "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add"
}
],
"release_date": "2026-08-13T11:28:22.807000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Information disclosure via environment variable expansion in URL handling"
},
{
"cve": "CVE-2026-73623",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-13T11:55:15.280313+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515275"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. An incomplete denylist in the `unsafe_git_clone_options` function fails to restrict the `--template` option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Remote Code Execution via malicious Git template",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important severity flaw in GitPython where an incomplete denylist in `unsafe_git_clone_options` allows remote code execution. An attacker can leverage the `--template` option to execute arbitrary commands during repository cloning by pointing to a directory containing malicious post-checkout hooks. This risk is present when applications using GitPython clone untrusted repositories.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73623"
},
{
"category": "external",
"summary": "RHBZ#2515275",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515275"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73623",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73623"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73623",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73623"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template",
"url": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template"
}
],
"release_date": "2026-08-13T11:28:23.477000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Remote Code Execution via malicious Git template"
},
{
"cve": "CVE-2026-73624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-08-13T11:51:01.223720+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515243"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability allows a remote attacker to overwrite arbitrary files on the system. By failing to properly validate git options passed to the `Diffable.diff` method, an attacker can supply a malicious output argument to write patch content to attacker-controlled file paths, leading to potential system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary File Overwrite via improper git option validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important arbitrary file overwrite vulnerability in GitPython\u0027s Diffable.diff method. It allows an attacker to write arbitrary content to chosen file paths at the process\u0027s privilege level by manipulating git options, which could lead to system compromise or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73624"
},
{
"category": "external",
"summary": "RHBZ#2515243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515243"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73624"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff",
"url": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff"
}
],
"release_date": "2026-08-13T11:28:24.155000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary File Overwrite via improper git option validation"
},
{
"cve": "CVE-2026-73625",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-13T11:54:49.542600+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515272"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. Attackers can bypass the `check_unsafe_options` guard by smuggling git options within single-character keyword argument (kwarg) values. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as `clone_from` or `fetch`, leading to arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Remote Code Execution via kwarg value smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important remote code execution vulnerability in GitPython, affecting Red Hat products that utilize GitPython versions prior to 3.1.54. The flaw allows an attacker to bypass input sanitization by smuggling malicious Git options within single-character keyword arguments, leading to arbitrary command execution when GitPython methods process untrusted input. This poses a significant risk to the integrity and confidentiality of systems.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73625"
},
{
"category": "external",
"summary": "RHBZ#2515272",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515272"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73625",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73625"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73625",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73625"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling",
"url": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling"
}
],
"release_date": "2026-08-13T11:28:24.833000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Remote Code Execution via kwarg value smuggling"
},
{
"cve": "CVE-2026-76218",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-08-19T14:12:37.531853+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519603"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the `Repo.init` function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on the initialized repository, these hooks execute arbitrary code, leading to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Remote Code Execution via malicious Git hooks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "GitPython\u0027s Repo.init forwards an unvalidated template parameter, letting an attacker who controls that parameter point at a directory of malicious git hooks that execute on subsequent git operations (RCE), fixed in 3.1.58. Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose the Repo.init template/options parameters to adversary-controlled input; the vulnerable parameter cannot be controlled by an attacker in these products, so they are marked not affected. GitPython as shipped in Red Hat OpenStack Platform 16.2 and 17.1 contains the vulnerable library code and retains its affected determination.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76218"
},
{
"category": "external",
"summary": "RHBZ#2519603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519603"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76218"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76218",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76218"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init",
"url": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init"
}
],
"release_date": "2026-08-19T14:02:02.729000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "workaround",
"details": "Do not pass untrusted or attacker-influenced input as the template parameter (or other forwarded options) to GitPython\u0027s Repo.init. Upgrade to GitPython 3.1.58 or later, where the unsafe option forwarding is fixed.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Remote Code Execution via malicious Git hooks"
},
{
"cve": "CVE-2026-76219",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-08-19T14:12:07.494177+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519597"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the `git read-tree` command through methods like `IndexFile.from_tree`, `IndexFile.reset`, and `IndexFile.merge_tree`, without proper option validation or argument separation, an attacker can cause the application to write a git-index blob to any attacker-controlled writable path, leading to data destruction.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary File Overwrite via `git read-tree` option injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "GitPython\u0027s IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree append caller-influenced treeish strings to `git read-tree` without option validation or argument separation, letting an attacker who controls those arguments inject the `--index-output` option to overwrite arbitrary files at attacker-controlled writable paths (data destruction), fixed in 3.1.58. Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose these IndexFile treeish arguments to adversary-controlled input; the vulnerable input cannot be controlled by an attacker in these products, so they are marked not affected. GitPython as shipped in Red Hat OpenStack Platform 16.2 and 17.1 contains the vulnerable library code and retains its affected determination.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76219"
},
{
"category": "external",
"summary": "RHBZ#2519597",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519597"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76219"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76219",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76219"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree",
"url": "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree"
}
],
"release_date": "2026-08-19T14:02:03.425000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "workaround",
"details": "Do not pass untrusted or attacker-influenced treeish arguments to GitPython\u0027s IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree. Upgrade to GitPython 3.1.58 or later, where option injection into `git read-tree` is fixed.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary File Overwrite via `git read-tree` option injection"
},
{
"cve": "CVE-2026-76220",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-19T14:13:21.277967+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519610"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. A remote attacker can bypass the `check_unsafe_options` guard by combining a single-character keyword argument with `split_single_char_options=False`. This allows the attacker to supply a crafted dictionary of keyword arguments to guarded methods, such as `clone_from`, leading to arbitrary operating system command execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary command execution via crafted kwargs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "GitPython\u0027s check_unsafe_options guard can be bypassed by combining a single-character keyword argument with split_single_char_options=False, letting an attacker who supplies a crafted kwargs dictionary to guarded methods such as clone_from emit a joined token parsed as `--upload-pack` and achieve arbitrary OS command execution even at the default allow_unsafe_options=False, fixed in 3.1.58. Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose these method keyword arguments to adversary-controlled input; the vulnerable input cannot be controlled by an attacker in these products, so they are marked not affected. GitPython as shipped in Red Hat OpenStack Platform 16.2 and 17.1 contains the vulnerable library code and retains its affected determination.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76220"
},
{
"category": "external",
"summary": "RHBZ#2519610",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519610"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76220",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76220"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76220",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76220"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options",
"url": "https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options"
}
],
"release_date": "2026-08-19T14:02:04.108000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "workaround",
"details": "Do not pass untrusted or attacker-influenced keyword arguments to GitPython\u0027s guarded methods such as clone_from, and do not set split_single_char_options=False on untrusted input. Upgrade to GitPython 3.1.58 or later, where the check_unsafe_options bypass is fixed.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary command execution via crafted kwargs"
},
{
"cve": "CVE-2026-76221",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-19T14:12:02.928636+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519596"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability allows attackers to inject malicious configuration options by manipulating option names within the option-name validator. By injecting special characters, an attacker can forge arbitrary git-config directives, potentially leading to arbitrary code execution on the system when a git operation is performed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary code execution via config-name injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "GitPython\u0027s option-name validator fails to neutralize equals signs, hash symbols, and whitespace in option names, letting an attacker who controls option names forge arbitrary git-config directives (e.g. `sshCommand = touch /tmp/RCE #`) that execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation, fixed in 3.1.58. Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose git option names to adversary-controlled input; the vulnerable input cannot be controlled by an attacker in these products, so they are marked not affected. GitPython as shipped in Red Hat OpenStack Platform 16.2 and 17.1 contains the vulnerable library code and retains its affected determination.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76221"
},
{
"category": "external",
"summary": "RHBZ#2519596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519596"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76221",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76221"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76221",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76221"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-option-name",
"url": "https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-option-name"
}
],
"release_date": "2026-08-19T14:02:04.795000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "workaround",
"details": "Do not pass untrusted or attacker-influenced git option names to GitPython. Upgrade to GitPython 3.1.58 or later, where option-name (config) injection is fixed.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary code execution via config-name injection"
},
{
"cve": "CVE-2026-76222",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-19T14:13:14.104704+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519609"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython where it fails to properly validate submodule names within .gitmodules files. A remote attacker could craft a malicious Git repository containing specially formed submodule names with directory traversal sequences. When GitPython processes these malicious submodule names during repository initialization, it could lead to the creation of attacker-controlled Git repositories at arbitrary locations on the filesystem, potentially impacting system integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "CVE-2026-76222 is a path-traversal flaw in GitPython submodule handling: cloning a malicious repository and initializing its submodules can create files or repositories outside the intended directory, because GitPython omits the suspicious-submodule-name guard that upstream core git enforces. Unlike the caller-gated GitPython option-forwarding flaws, this triggers during ordinary clone plus submodule initialization of an untrusted repository, so any Red Hat product that ships or bundles a vulnerable GitPython version is affected. Fixed in GitPython 3.1.58.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76222"
},
{
"category": "external",
"summary": "RHBZ#2519609",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519609"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76222",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76222"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76222",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76222"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name",
"url": "https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name"
}
],
"release_date": "2026-08-19T14:02:05.596000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
},
{
"category": "workaround",
"details": "There is no mitigation beyond not cloning or initializing git submodules from untrusted repositories. Upgrade to GitPython 3.1.58 or later when it becomes available.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names"
},
{
"cve": "CVE-2026-78676",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-08-25T01:52:20.869828+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2523197"
}
],
"notes": [
{
"category": "description",
"text": "GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython before 3.1.59 Remote Code Execution via Config Injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Case for AC:H (8.1): the trigger needs two things the attacker does not\n straightforwardly own:\n (1) a crafted multi-line quoted value must already sit DORMANT in .git/config\n \u2014 the guarded set_value() path will not put it there; it must arrive via\n _read() of a file the attacker influenced but does not directly write; and\n (2) a SUBSEQUENT, UNRELATED GitPython config WRITE must fire to re-serialize\n and corrupt it \u2014 and that write is performed by the victim application on\n its own schedule, not by the attacker. \n \"Prepare the target environment\" + \"conditions beyond the attacker\u0027s control\"\n is the textbook AC:H definition; step (2) in particular fits it.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-78676"
},
{
"category": "external",
"summary": "RHBZ#2523197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523197"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-78676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-78676"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78676",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78676"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection",
"url": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection"
}
],
"release_date": "2026-08-25T01:30:33.754000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:53:11+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68776"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:24ebda962c61b717d8c4f4aff70ba900d3f8c2a278cd03b9d16ace83f8ac2259_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "gitpython: GitPython before 3.1.59 Remote Code Execution via Config Injection"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…