Linux · 
openSUSE Leap · Security advisory · September 18, 2026
openSUSE Leap · Security advisory · September 18, 2026OPENSUSE-SU-2026:21874-1: python-GitPython security update
OPENSUSE-SU-2026:21874-1, released September 18, 2026, fixes 26 CVEs in python-GitPython (version 3.1.44-160000.4.1). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
26
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0221
82nd percentile
Priority of the 26 CVEs
Patch now 0
Urgent 0
High 5
Routine 21
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| python-GitPython | opensuse-leap 16.0 | 3.1.44-160000.4.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2026-73623 | python-git: GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing a... | 8.8 | 0.0096 | None reported |
| High | CVE-2026-76218 | python-git: GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options... | 8.8 | 0.0072 | None reported |
| High | CVE-2026-69097 | python-git: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbi... | 7.3 | 0.0027 | None reported |
| High | CVE-2026-67326 | python-git: GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing at... | 7.8 | 0.0025 | None reported |
| High | CVE-2026-78675 | python-git: GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose loca... | 7.8 | 0.0018 | None reported |
| Routine | CVE-2026-67325 | python-git: GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-optio... | n/a | 0.0221 | None reported |
| Routine | CVE-2026-67323 | python-git: GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() an... | n/a | 0.0125 | None reported |
| Routine | CVE-2026-73625 | python-git: GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that... | n/a | 0.0068 | None reported |
| Routine | CVE-2026-78677 | python-git: GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrar... | n/a | 0.0065 | None reported |
| Routine | CVE-2026-76220 | python-git: GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypa... | n/a | 0.0059 | None reported |
| Routine | CVE-2026-73620 | python-git: GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allow... | n/a | 0.0057 | None reported |
| Routine | CVE-2026-78676 | python-git: GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting... | n/a | 0.0056 | None reported |
| Routine | CVE-2026-73624 | python-git: GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that f... | n/a | 0.0055 | None reported |
| Routine | CVE-2026-76219 | python-git: GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.... | n/a | 0.0054 | None reported |
| Routine | CVE-2026-87819 | python-git: GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that... | n/a | 0.0052 | None reported |
| Routine | CVE-2026-73622 | python-git: GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL ha... | n/a | 0.0051 | None reported |
| Routine | CVE-2026-76221 | python-git: GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attac... | n/a | 0.0049 | None reported |
| Routine | CVE-2026-76222 | python-git: GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git re... | n/a | 0.0042 | None reported |
| Routine | CVE-2026-87817 | python-git: GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the... | n/a | 0.0042 | None reported |
| Routine | CVE-2026-73619 | python-git: GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file... | n/a | 0.0041 | None reported |
| Routine | CVE-2026-76217 | python-git: GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.rem... | n/a | 0.0041 | None reported |
| Routine | CVE-2026-78678 | python-git: GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits -... | n/a | 0.0041 | None reported |
| Routine | CVE-2026-87818 | python-git: GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbit... | n/a | 0.0041 | None reported |
| Routine | CVE-2026-73621 | python-git: GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards key... | n/a | 0.0036 | None reported |
| Routine | CVE-2026-67322 | python-git: GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from() | n/a | 0.0033 | None reported |
Showing 1 to 25 of 26
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.