gitpython 3.1.44

Direct Vulnerabilities

Known vulnerabilities in the gitpython package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Command Injection GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Command Injection via the `set_value` function when the `section` parameter is not properly validated for newline characters. An attacker can execute arbitrary code by injecting malicious section headers into the `.git/config` file, which can redirect `core.hooksPath` to an attacker-controlled directory and trigger execution when a git hook runs. Note: This vulnerability bypasses the patch for CVE-2026-42215. How to fix Command Injection? Upgrade `GitPython` to version 3.1.50 or higher.	[,3.1.50)
H Arbitrary Code Injection GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Code Injection via the `set_value` function. An attacker can achieve arbitrary code execution by injecting newline characters into configuration values, which allows the creation of malicious Git configuration entries such as `core.hooksPath`. This enables execution of attacker-controlled scripts during Git operations that invoke hooks. How to fix Arbitrary Code Injection? Upgrade `GitPython` to version 3.1.49 or higher.	[,3.1.49)
H Directory Traversal GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Directory Traversal through insufficient validation of reference paths in the creation, renaming, and deletion. An attacker can write, overwrite, move, or delete files outside the intended directory by supplying crafted reference paths to the relevant APIs. How to fix Directory Traversal? Upgrade `GitPython` to version 3.1.48 or higher.	[,3.1.48)
H Command Injection GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Command Injection via the `upload_pack` or `receive_pack` kwargs in the `Repo.clone_from`, `Remote.fetch`, `Remote.pull`, or `Remote.push` functions. An attacker can execute arbitrary commands on the host system by supplying malicious keyword arguments. How to fix Command Injection? Upgrade `GitPython` to version 3.1.47 or higher.	[3.1.30,3.1.47)
C Arbitrary Argument Injection GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection in the `multi_options` parameter of the `_clone` function, which may be passed in via the `clone_from()`, `clone()`, or `Submodule.update()` functions. An attacker can execute arbitrary code by supplying specially crafted input that manipulates Git configuration options, leading to the execution of malicious hooks during cloning. How to fix Arbitrary Argument Injection? Upgrade `GitPython` to version 3.1.47 or higher.	[,3.1.47)

Vulnerability

Vulnerable Version

Command Injection

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Command Injection via the set_value function when the section parameter is not properly validated for newline characters. An attacker can execute arbitrary code by injecting malicious section headers into the .git/config file, which can redirect core.hooksPath to an attacker-controlled directory and trigger execution when a git hook runs.

Note: This vulnerability bypasses the patch for CVE-2026-42215.

How to fix Command Injection?

Upgrade GitPython to version 3.1.50 or higher.

[,3.1.50)

Arbitrary Code Injection

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Arbitrary Code Injection via the set_value function. An attacker can achieve arbitrary code execution by injecting newline characters into configuration values, which allows the creation of malicious Git configuration entries such as core.hooksPath. This enables execution of attacker-controlled scripts during Git operations that invoke hooks.

How to fix Arbitrary Code Injection?

Upgrade GitPython to version 3.1.49 or higher.

[,3.1.49)

Directory Traversal

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Directory Traversal through insufficient validation of reference paths in the creation, renaming, and deletion. An attacker can write, overwrite, move, or delete files outside the intended directory by supplying crafted reference paths to the relevant APIs.

How to fix Directory Traversal?

Upgrade GitPython to version 3.1.48 or higher.

[,3.1.48)

Command Injection

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Command Injection via the upload_pack or receive_pack kwargs in the Repo.clone_from, Remote.fetch, Remote.pull, or Remote.push functions. An attacker can execute arbitrary commands on the host system by supplying malicious keyword arguments.

How to fix Command Injection?

Upgrade GitPython to version 3.1.47 or higher.

[3.1.30,3.1.47)

Arbitrary Argument Injection

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Arbitrary Argument Injection in the multi_options parameter of the _clone function, which may be passed in via the clone_from(), clone(), or Submodule.update() functions. An attacker can execute arbitrary code by supplying specially crafted input that manipulates Git configuration options, leading to the execution of malicious hooks during cloning.

How to fix Arbitrary Argument Injection?

Upgrade GitPython to version 3.1.47 or higher.

[,3.1.47)

gitpython@3.1.44

GitPython is a Python library used to interact with Git repositories

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically