{
  "fix": "OPENSUSE-SU-2026:21874-1",
  "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21874-1",
  "summary": "OPENSUSE-SU-2026:21874-1, released September 18, 2026, fixes 26 CVEs in python-GitPython (version 3.1.44-160000.4.1). None of them is reported as exploited. Patch Radar priority: High.",
  "platform": "linux",
  "type": "advisory",
  "title": "python-GitPython security update",
  "released": "2026-09-18T06:05:46Z",
  "priority": "High",
  "priorityTier": 3,
  "priorityReason": "Closes CVE-2026-73623, high severity",
  "supported": true,
  "cveCount": 26,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.02209,
  "maxCvss": 8.8,
  "vendorAdvisory": "https://osv.dev/vulnerability/openSUSE-SU-2026:21874-1",
  "appliesTo": [
    {
      "product": "python-GitPython",
      "productUrl": "https://patchblox.com/security/product/linux/python-gitpython",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.1.44-160000.4.1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2026-73623",
      "url": "https://patchblox.com/security/cve/CVE-2026-73623",
      "title": "python-git: GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing a...",
      "priority": "High",
      "severity": "high",
      "cvss": 8.8,
      "epss": 0.00961,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76218",
      "url": "https://patchblox.com/security/cve/CVE-2026-76218",
      "title": "python-git: GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options...",
      "priority": "High",
      "severity": "high",
      "cvss": 8.8,
      "epss": 0.0072,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-69097",
      "url": "https://patchblox.com/security/cve/CVE-2026-69097",
      "title": "python-git: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbi...",
      "priority": "High",
      "severity": "high",
      "cvss": 7.3,
      "epss": 0.00268,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-67326",
      "url": "https://patchblox.com/security/cve/CVE-2026-67326",
      "title": "python-git: GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing at...",
      "priority": "High",
      "severity": "high",
      "cvss": 7.8,
      "epss": 0.00254,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-78675",
      "url": "https://patchblox.com/security/cve/CVE-2026-78675",
      "title": "python-git: GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose loca...",
      "priority": "High",
      "severity": "high",
      "cvss": 7.8,
      "epss": 0.00178,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-67325",
      "url": "https://patchblox.com/security/cve/CVE-2026-67325",
      "title": "python-git: GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git\u0027s long-optio...",
      "priority": "Routine",
      "epss": 0.02209,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-67323",
      "url": "https://patchblox.com/security/cve/CVE-2026-67323",
      "title": "python-git: GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() an...",
      "priority": "Routine",
      "epss": 0.01251,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73625",
      "url": "https://patchblox.com/security/cve/CVE-2026-73625",
      "title": "python-git: GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that...",
      "priority": "Routine",
      "epss": 0.00676,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-78677",
      "url": "https://patchblox.com/security/cve/CVE-2026-78677",
      "title": "python-git: GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrar...",
      "priority": "Routine",
      "epss": 0.00651,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76220",
      "url": "https://patchblox.com/security/cve/CVE-2026-76220",
      "title": "python-git: GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypa...",
      "priority": "Routine",
      "epss": 0.0059,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73620",
      "url": "https://patchblox.com/security/cve/CVE-2026-73620",
      "title": "python-git: GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allow...",
      "priority": "Routine",
      "epss": 0.00574,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-78676",
      "url": "https://patchblox.com/security/cve/CVE-2026-78676",
      "title": "python-git: GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting...",
      "priority": "Routine",
      "epss": 0.00556,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73624",
      "url": "https://patchblox.com/security/cve/CVE-2026-73624",
      "title": "python-git: GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that f...",
      "priority": "Routine",
      "epss": 0.00553,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76219",
      "url": "https://patchblox.com/security/cve/CVE-2026-76219",
      "title": "python-git: GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile....",
      "priority": "Routine",
      "epss": 0.00543,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-87819",
      "url": "https://patchblox.com/security/cve/CVE-2026-87819",
      "title": "python-git: GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that...",
      "priority": "Routine",
      "epss": 0.00521,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73622",
      "url": "https://patchblox.com/security/cve/CVE-2026-73622",
      "title": "python-git: GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL ha...",
      "priority": "Routine",
      "epss": 0.00514,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76221",
      "url": "https://patchblox.com/security/cve/CVE-2026-76221",
      "title": "python-git: GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attac...",
      "priority": "Routine",
      "epss": 0.00485,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76222",
      "url": "https://patchblox.com/security/cve/CVE-2026-76222",
      "title": "python-git: GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git re...",
      "priority": "Routine",
      "epss": 0.00422,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-87817",
      "url": "https://patchblox.com/security/cve/CVE-2026-87817",
      "title": "python-git: GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the...",
      "priority": "Routine",
      "epss": 0.00419,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73619",
      "url": "https://patchblox.com/security/cve/CVE-2026-73619",
      "title": "python-git: GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file...",
      "priority": "Routine",
      "epss": 0.00412,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76217",
      "url": "https://patchblox.com/security/cve/CVE-2026-76217",
      "title": "python-git: GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.rem...",
      "priority": "Routine",
      "epss": 0.00412,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-78678",
      "url": "https://patchblox.com/security/cve/CVE-2026-78678",
      "title": "python-git: GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits -...",
      "priority": "Routine",
      "epss": 0.00412,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-87818",
      "url": "https://patchblox.com/security/cve/CVE-2026-87818",
      "title": "python-git: GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbit...",
      "priority": "Routine",
      "epss": 0.00412,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73621",
      "url": "https://patchblox.com/security/cve/CVE-2026-73621",
      "title": "python-git: GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards key...",
      "priority": "Routine",
      "epss": 0.0036,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-67322",
      "url": "https://patchblox.com/security/cve/CVE-2026-67322",
      "title": "python-git: GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from()",
      "priority": "Routine",
      "epss": 0.00328,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-78679",
      "url": "https://patchblox.com/security/cve/CVE-2026-78679",
      "title": "python-git: GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional ref...",
      "priority": "Routine",
      "epss": 0.00316,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}