Linux · SUSE Linux Enterprise · Security advisory · September 8, 2026
SUSE-SU-2026:4072-1: python-GitPython security update
SUSE-SU-2026:4072-1, released September 8, 2026, fixes 27 CVEs in python-GitPython (version 3.1.34.1693646983.2a2ae77-150400.9.8.1). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
27
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0221
82nd percentile
Priority of the 27 CVEs
Patch now 0
Urgent 1
High 8
Routine 18
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| python-GitPython | sles 15.6 | 3.1.34.1693646983.2a2ae77-150400.9.8.1 |
| python-GitPython | sles 15.7 | 3.1.34.1693646983.2a2ae77-150400.9.8.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-42284 | python-git: GitPython is a python library used to interact with Git repositories | 9.8 | 0.0057 | None reported |
| High | CVE-2026-73623 | python-git: GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing a... | 8.8 | 0.0096 | None reported |
| High | CVE-2026-42215 | python-git: GitPython is a python library used to interact with Git repositories | 8.8 | 0.0075 | None reported |
| High | CVE-2026-76218 | python-git: GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options... | 8.8 | 0.0072 | None reported |
| High | CVE-2026-44243 | python-git: GitPython is a python library used to interact with Git repositories | 7.1 | 0.0042 | None reported |
| High | CVE-2026-69097 | python-git: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbi... | 7.3 | 0.0027 | None reported |
| High | CVE-2026-67326 | python-git: GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing at... | 7.8 | 0.0025 | None reported |
| High | CVE-2026-44244 | python-git: GitPython is a python library used to interact with Git repositories | 7.8 | 0.0024 | None reported |
| High | CVE-2026-78675 | python-git: GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose loca... | 7.8 | 0.0018 | None reported |
| Routine | CVE-2026-67325 | python-git: GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-optio... | n/a | 0.0221 | None reported |
| Routine | CVE-2026-67323 | python-git: GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() an... | n/a | 0.0125 | None reported |
| Routine | CVE-2026-73625 | python-git: GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that... | n/a | 0.0068 | None reported |
| Routine | CVE-2026-78677 | python-git: GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrar... | n/a | 0.0065 | None reported |
| Routine | CVE-2026-76220 | python-git: GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypa... | n/a | 0.0059 | None reported |
| Routine | CVE-2026-73620 | python-git: GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allow... | n/a | 0.0057 | None reported |
| Routine | CVE-2026-78676 | python-git: GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting... | n/a | 0.0056 | None reported |
| Routine | CVE-2026-73624 | python-git: GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that f... | n/a | 0.0055 | None reported |
| Routine | CVE-2026-76219 | python-git: GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.... | n/a | 0.0054 | None reported |
| Routine | CVE-2026-73622 | python-git: GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL ha... | n/a | 0.0051 | None reported |
| Routine | CVE-2026-76221 | python-git: GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attac... | n/a | 0.0049 | None reported |
| Routine | CVE-2026-76222 | python-git: GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git re... | n/a | 0.0042 | None reported |
| Routine | CVE-2026-73619 | python-git: GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file... | n/a | 0.0041 | None reported |
| Routine | CVE-2026-76217 | python-git: GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.rem... | n/a | 0.0041 | None reported |
| Routine | CVE-2026-78678 | python-git: GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits -... | n/a | 0.0041 | None reported |
| Routine | CVE-2026-73621 | python-git: GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards key... | n/a | 0.0036 | None reported |
Showing 1 to 25 of 27
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.