{
  "fix": "SUSE-SU-2026:4072-1",
  "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4072-1",
  "summary": "SUSE-SU-2026:4072-1, released September 8, 2026, fixes 27 CVEs in python-GitPython (version 3.1.34.1693646983.2a2ae77-150400.9.8.1). None of them is reported as exploited. Patch Radar priority: Urgent.",
  "platform": "linux",
  "type": "advisory",
  "title": "python-GitPython security update",
  "released": "2026-09-08T07:07:35Z",
  "priority": "Urgent",
  "priorityTier": 2,
  "priorityReason": "Closes CVE-2026-42284, rated Critical",
  "supported": true,
  "cveCount": 27,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.02209,
  "maxCvss": 9.8,
  "vendorAdvisory": "https://osv.dev/vulnerability/SUSE-SU-2026:4072-1",
  "appliesTo": [
    {
      "product": "python-GitPython",
      "productUrl": "https://patchblox.com/security/product/linux/python-gitpython",
      "release": "sles 15.6",
      "fixedVersion": "3.1.34.1693646983.2a2ae77-150400.9.8.1",
      "supported": true
    },
    {
      "product": "python-GitPython",
      "productUrl": "https://patchblox.com/security/product/linux/python-gitpython",
      "release": "sles 15.7",
      "fixedVersion": "3.1.34.1693646983.2a2ae77-150400.9.8.1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2026-42284",
      "url": "https://patchblox.com/security/cve/CVE-2026-42284",
      "title": "python-git: GitPython is a python library used to interact with Git repositories",
      "priority": "Urgent",
      "severity": "critical",
      "cvss": 9.8,
      "epss": 0.00571,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73623",
      "url": "https://patchblox.com/security/cve/CVE-2026-73623",
      "title": "python-git: GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing a...",
      "priority": "High",
      "severity": "high",
      "cvss": 8.8,
      "epss": 0.00961,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-42215",
      "url": "https://patchblox.com/security/cve/CVE-2026-42215",
      "title": "python-git: GitPython is a python library used to interact with Git repositories",
      "priority": "High",
      "severity": "high",
      "cvss": 8.8,
      "epss": 0.00749,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76218",
      "url": "https://patchblox.com/security/cve/CVE-2026-76218",
      "title": "python-git: GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options...",
      "priority": "High",
      "severity": "high",
      "cvss": 8.8,
      "epss": 0.0072,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-44243",
      "url": "https://patchblox.com/security/cve/CVE-2026-44243",
      "title": "python-git: GitPython is a python library used to interact with Git repositories",
      "priority": "High",
      "severity": "high",
      "cvss": 7.1,
      "epss": 0.00419,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-69097",
      "url": "https://patchblox.com/security/cve/CVE-2026-69097",
      "title": "python-git: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbi...",
      "priority": "High",
      "severity": "high",
      "cvss": 7.3,
      "epss": 0.00268,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-67326",
      "url": "https://patchblox.com/security/cve/CVE-2026-67326",
      "title": "python-git: GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing at...",
      "priority": "High",
      "severity": "high",
      "cvss": 7.8,
      "epss": 0.00254,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-44244",
      "url": "https://patchblox.com/security/cve/CVE-2026-44244",
      "title": "python-git: GitPython is a python library used to interact with Git repositories",
      "priority": "High",
      "severity": "high",
      "cvss": 7.8,
      "epss": 0.00237,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-78675",
      "url": "https://patchblox.com/security/cve/CVE-2026-78675",
      "title": "python-git: GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose loca...",
      "priority": "High",
      "severity": "high",
      "cvss": 7.8,
      "epss": 0.00178,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-67325",
      "url": "https://patchblox.com/security/cve/CVE-2026-67325",
      "title": "python-git: GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git\u0027s long-optio...",
      "priority": "Routine",
      "epss": 0.02209,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-67323",
      "url": "https://patchblox.com/security/cve/CVE-2026-67323",
      "title": "python-git: GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() an...",
      "priority": "Routine",
      "epss": 0.01251,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73625",
      "url": "https://patchblox.com/security/cve/CVE-2026-73625",
      "title": "python-git: GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that...",
      "priority": "Routine",
      "epss": 0.00676,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-78677",
      "url": "https://patchblox.com/security/cve/CVE-2026-78677",
      "title": "python-git: GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrar...",
      "priority": "Routine",
      "epss": 0.00651,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76220",
      "url": "https://patchblox.com/security/cve/CVE-2026-76220",
      "title": "python-git: GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypa...",
      "priority": "Routine",
      "epss": 0.0059,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73620",
      "url": "https://patchblox.com/security/cve/CVE-2026-73620",
      "title": "python-git: GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allow...",
      "priority": "Routine",
      "epss": 0.00574,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-78676",
      "url": "https://patchblox.com/security/cve/CVE-2026-78676",
      "title": "python-git: GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting...",
      "priority": "Routine",
      "epss": 0.00556,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73624",
      "url": "https://patchblox.com/security/cve/CVE-2026-73624",
      "title": "python-git: GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that f...",
      "priority": "Routine",
      "epss": 0.00553,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76219",
      "url": "https://patchblox.com/security/cve/CVE-2026-76219",
      "title": "python-git: GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile....",
      "priority": "Routine",
      "epss": 0.00543,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73622",
      "url": "https://patchblox.com/security/cve/CVE-2026-73622",
      "title": "python-git: GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL ha...",
      "priority": "Routine",
      "epss": 0.00514,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76221",
      "url": "https://patchblox.com/security/cve/CVE-2026-76221",
      "title": "python-git: GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attac...",
      "priority": "Routine",
      "epss": 0.00485,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76222",
      "url": "https://patchblox.com/security/cve/CVE-2026-76222",
      "title": "python-git: GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git re...",
      "priority": "Routine",
      "epss": 0.00422,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73619",
      "url": "https://patchblox.com/security/cve/CVE-2026-73619",
      "title": "python-git: GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file...",
      "priority": "Routine",
      "epss": 0.00412,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76217",
      "url": "https://patchblox.com/security/cve/CVE-2026-76217",
      "title": "python-git: GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.rem...",
      "priority": "Routine",
      "epss": 0.00412,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-78678",
      "url": "https://patchblox.com/security/cve/CVE-2026-78678",
      "title": "python-git: GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits -...",
      "priority": "Routine",
      "epss": 0.00412,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73621",
      "url": "https://patchblox.com/security/cve/CVE-2026-73621",
      "title": "python-git: GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards key...",
      "priority": "Routine",
      "epss": 0.0036,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-67322",
      "url": "https://patchblox.com/security/cve/CVE-2026-67322",
      "title": "python-git: GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from()",
      "priority": "Routine",
      "epss": 0.00328,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-78679",
      "url": "https://patchblox.com/security/cve/CVE-2026-78679",
      "title": "python-git: GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional ref...",
      "priority": "Routine",
      "epss": 0.00316,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}