Vendor
GitPython Argument Injection in IndexFile and TagReference
1 TTPGitPython fails to sanitize keyword arguments passed to git commands, allowing attackers to perform arbitrary file overwrites and unauthorized file reads.
Environment Variable Exfiltration in GitPython
1 TTP 1 CVEGitPython versions prior to 3.1.52 are vulnerable to environment variable exfiltration when an attacker provides a crafted remote URL to the Repo.clone_from() method.
GitPython Environment Variable Exfiltration via Remote URL Processing
2 TTPs 2 IOCsA vulnerability in GitPython allows environment variables to be exfiltrated when using `Repo.create_remote()` or `Remote.add()`, where attacker-supplied URLs are processed by `Git.polish_url()` expanding sensitive environment variables into the URL, which is then stored in `.git/config` and transmitted to an attacker-controlled host.
GitPython Incomplete Denylist Allows Arbitrary Command Execution via Git Clone Hooks
1 rule 3 TTPsA critical vulnerability in GitPython versions up to 3.1.53 allows attackers to achieve arbitrary command execution by influencing `git clone` options to include a malicious `--template` directory, which causes Git hooks to be copied and executed during cloning, even in default configurations.
GitPython config_writer() Newline Injection Bypasses CVE-2026-42215 Patch
2 rules 3 TTPs 1 CVEAn incomplete patch for CVE-2026-42215 in GitPython allows newline injection in the section parameter of the config_writer() function, enabling arbitrary .git/config modification and remote code execution via core.hooksPath.
GitPython config_writer().set_value() Newline Injection RCE
2 rules 1 TTPA newline injection vulnerability in GitPython's `config_writer().set_value()` function enables remote code execution by manipulating the `core.hooksPath` Git configuration.