[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-42215":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":40,"aliases":50,"duplicate_of":9,"upstream":70,"downstream":71,"duplicates":89,"related":90,"reserved_at":9,"published_at":95,"modified_at":96,"state":97,"summary":98,"references_raw":106,"kevs":147,"epss":148,"epss_history":151,"metrics":427,"affected":443},"CVE-2026-42215","GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-78","Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","weakness","Stable","Base","High",[20,24,28,32,36],{"id":21,"name":22,"techniques":23},"CAPEC-108","Command Line Execution through SQL Injection",[],{"id":25,"name":26,"techniques":27},"CAPEC-15","Command Delimiters",[],{"id":29,"name":30,"techniques":31},"CAPEC-43","Exploiting Multiple Input Interpretation Layers",[],{"id":33,"name":34,"techniques":35},"CAPEC-6","Argument Injection",[],{"id":37,"name":38,"techniques":39},"CAPEC-88","OS Command Injection",[],[41],{"_key":42,"name":43,"source":44,"url":45,"maturity":46,"reliability_score":47,"verified":48,"type":9,"platforms":49,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_GITPYTHON-DEVELOPERS_GITPYTHON","Gitpython","github","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4","poc",0.3,false,[],[51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69],"GHSA-rpm5-65cw-6hj4","PYSEC-2026-2160","DEBIAN-CVE-2026-42215","CGA-5fhg-8jgp-9h8j","CGA-5frm-5q55-39hw","CGA-6q5g-r7m5-p2h2","CGA-8w65-44qv-r5cj","CGA-36f4-q2xc-4mrm","CGA-8wjg-rm5q-rgcj","CGA-9w48-226r-mggw","CGA-cqrp-4cxp-58vq","CGA-j988-cq99-fmmp","CGA-jcj2-247q-w8cv","CGA-q845-jfm3-83jj","CGA-rpxw-xpj8-xfpv","CGA-vfp5-gxcx-7xwv","CGA-vwm7-c3g3-g2w7","CGA-jrgh-m3vj-xr9c","CGA-v2m8-hrvg-w5vg",[],[72,74,76,78,79,81,83,85,87],{"_key":73},"OPENSUSE-SU-2026:10758-1",{"_key":75},"UBUNTU-CVE-2026-42215",{"_key":77},"USN-8303-1",{"_key":53},{"_key":80},"MGASA-2026-0372",{"_key":82},"SUSE-SU-2026:4072-1",{"_key":84},"RHSA-2026:42078",{"_key":86},"RHSA-2026:42079",{"_key":88},"RHSA-2026:63385",[],[91,92,93],{"_key":73},{"_key":82},{"_key":94},"CGA-4VJV-WCM3-R5V5","2026-05-07T18:17:03.194Z","2026-05-09T03:56:00.861Z","Analyzed",{"cisa_kev":48,"cisa_ransomware":48,"cisa_vendor":9,"epss_severity":99,"epss_score":100,"severity":101,"severity_score":102,"severity_version":103,"severity_source":104,"severity_vector":105,"severity_status":97},"low",0.00749,"high",8.8,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",[107,121,126,134,138,143],{"url":108,"sources":109,"tags":114},"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4",[110,104,111,112,113],"osv_pypi","nvd","osv_wolfi","osv_chainguard",[115,116,117,118,119,120],"WEB","X Refsource CONFIRM","Exploit","Vendor Advisory","EVIDENCE","Advisory",{"url":122,"sources":123,"tags":124},"https://github.com/gitpython-developers/GitPython",[110],[125],"PACKAGE",{"url":127,"sources":128,"tags":129},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47",[104,111,110,112,113],[130,115,131,132,133],"X Refsource MISC","Patch","Release Notes","FIX",{"url":135,"sources":136,"tags":137},"https://nvd.nist.gov/vuln/detail/CVE-2026-42215",[110,112,113],[120],{"url":139,"sources":140,"tags":142},"https://security-tracker.debian.org/tracker/CVE-2026-42215",[141],"osv_debian",[120],{"url":144,"sources":145,"tags":146},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42215.json",[112,113],[120],[],{"date":149,"score":100,"percentile":150},"2026-09-19",0.53398,[152,156,159,162,165,169,173,176,179,182,185,188,191,194,197,201,204,207,210,213,216,219,222,225,228,231,234,237,240,243,246,249,253,256,259,262,265,268,271,275,278,281,284,287,290,293,296,299,302,305,308,311,314,316,319,322,325,328,331,334,337,340,343,346,349,352,355,358,361,364,367,370,373,376,379,382,385,388,391,394,397,400,403,406,409,412,415,418,421,424],{"date":153,"score":154,"percentile":155},"2026-05-08",0.00091,0.25432,{"date":157,"score":154,"percentile":158},"2026-05-09",0.25485,{"date":160,"score":154,"percentile":161},"2026-05-10",0.25452,{"date":163,"score":154,"percentile":164},"2026-05-11",0.25405,{"date":166,"score":167,"percentile":168},"2026-05-12",0.00083,0.23986,{"date":170,"score":171,"percentile":172},"2026-05-13",0.00093,0.25789,{"date":174,"score":171,"percentile":175},"2026-05-14",0.25815,{"date":177,"score":171,"percentile":178},"2026-05-15",0.25842,{"date":180,"score":171,"percentile":181},"2026-05-16",0.25835,{"date":183,"score":171,"percentile":184},"2026-05-17",0.25777,{"date":186,"score":171,"percentile":187},"2026-05-18",0.25716,{"date":189,"score":171,"percentile":190},"2026-05-19",0.25717,{"date":192,"score":171,"percentile":193},"2026-05-20",0.25728,{"date":195,"score":171,"percentile":196},"2026-05-21",0.25727,{"date":198,"score":199,"percentile":200},"2026-05-22",0.0003,0.08933,{"date":202,"score":199,"percentile":203},"2026-05-23",0.08924,{"date":205,"score":199,"percentile":206},"2026-05-24",0.08926,{"date":208,"score":199,"percentile":209},"2026-05-25",0.08914,{"date":211,"score":199,"percentile":212},"2026-05-26",0.08909,{"date":214,"score":199,"percentile":215},"2026-05-27",0.08967,{"date":217,"score":199,"percentile":218},"2026-05-28",0.09111,{"date":220,"score":199,"percentile":221},"2026-05-29",0.09152,{"date":223,"score":199,"percentile":224},"2026-05-30",0.09155,{"date":226,"score":199,"percentile":227},"2026-05-31",0.09137,{"date":229,"score":199,"percentile":230},"2026-06-01",0.09115,{"date":232,"score":199,"percentile":233},"2026-06-02",0.09062,{"date":235,"score":199,"percentile":236},"2026-06-03",0.09016,{"date":238,"score":199,"percentile":239},"2026-06-04",0.09031,{"date":241,"score":199,"percentile":242},"2026-06-05",0.09072,{"date":244,"score":199,"percentile":245},"2026-06-06",0.09089,{"date":247,"score":199,"percentile":248},"2026-06-07",0.09068,{"date":250,"score":251,"percentile":252},"2026-06-08",0.00034,0.10481,{"date":254,"score":251,"percentile":255},"2026-06-09",0.10505,{"date":257,"score":251,"percentile":258},"2026-06-10",0.10541,{"date":260,"score":251,"percentile":261},"2026-06-11",0.10578,{"date":263,"score":251,"percentile":264},"2026-06-12",0.10638,{"date":266,"score":251,"percentile":267},"2026-06-13",0.10641,{"date":269,"score":251,"percentile":270},"2026-06-14",0.10616,{"date":272,"score":273,"percentile":274},"2026-06-15",0.00719,0.48851,{"date":276,"score":273,"percentile":277},"2026-06-16",0.489,{"date":279,"score":273,"percentile":280},"2026-06-17",0.48967,{"date":282,"score":273,"percentile":283},"2026-06-18",0.49003,{"date":285,"score":273,"percentile":286},"2026-06-19",0.48999,{"date":288,"score":273,"percentile":289},"2026-06-20",0.48993,{"date":291,"score":273,"percentile":292},"2026-06-21",0.48978,{"date":294,"score":273,"percentile":295},"2026-06-22",0.48972,{"date":297,"score":273,"percentile":298},"2026-06-23",0.49031,{"date":300,"score":273,"percentile":301},"2026-06-24",0.49066,{"date":303,"score":273,"percentile":304},"2026-06-25",0.49145,{"date":306,"score":273,"percentile":307},"2026-06-26",0.49184,{"date":309,"score":273,"percentile":310},"2026-06-27",0.49226,{"date":312,"score":273,"percentile":313},"2026-06-28",0.49222,{"date":315,"score":273,"percentile":313},"2026-06-29",{"date":317,"score":273,"percentile":318},"2026-06-30",0.49212,{"date":320,"score":273,"percentile":321},"2026-07-01",0.49301,{"date":323,"score":273,"percentile":324},"2026-07-02",0.49338,{"date":326,"score":273,"percentile":327},"2026-07-03",0.49353,{"date":329,"score":273,"percentile":330},"2026-07-04",0.49378,{"date":332,"score":273,"percentile":333},"2026-07-05",0.49387,{"date":335,"score":273,"percentile":336},"2026-07-06",0.49394,{"date":338,"score":273,"percentile":339},"2026-07-07",0.49403,{"date":341,"score":273,"percentile":342},"2026-07-08",0.49415,{"date":344,"score":273,"percentile":345},"2026-07-09",0.49481,{"date":347,"score":273,"percentile":348},"2026-07-10",0.49511,{"date":350,"score":273,"percentile":351},"2026-07-11",0.49541,{"date":353,"score":273,"percentile":354},"2026-07-12",0.49536,{"date":356,"score":273,"percentile":357},"2026-07-13",0.49565,{"date":359,"score":273,"percentile":360},"2026-07-14",0.49581,{"date":362,"score":273,"percentile":363},"2026-07-15",0.49676,{"date":365,"score":273,"percentile":366},"2026-07-16",0.49706,{"date":368,"score":273,"percentile":369},"2026-07-17",0.49725,{"date":371,"score":273,"percentile":372},"2026-07-18",0.49738,{"date":374,"score":273,"percentile":375},"2026-07-19",0.49744,{"date":377,"score":273,"percentile":378},"2026-07-20",0.49802,{"date":380,"score":273,"percentile":381},"2026-07-21",0.49828,{"date":383,"score":273,"percentile":384},"2026-07-22",0.50019,{"date":386,"score":273,"percentile":387},"2026-07-23",0.50038,{"date":389,"score":100,"percentile":390},"2026-07-24",0.51093,{"date":392,"score":100,"percentile":393},"2026-07-25",0.51138,{"date":395,"score":100,"percentile":396},"2026-07-26",0.51135,{"date":398,"score":100,"percentile":399},"2026-07-27",0.51132,{"date":401,"score":100,"percentile":402},"2026-07-28",0.51186,{"date":404,"score":100,"percentile":405},"2026-07-29",0.51218,{"date":407,"score":100,"percentile":408},"2026-07-30",0.51294,{"date":410,"score":100,"percentile":411},"2026-07-31",0.51326,{"date":413,"score":100,"percentile":414},"2026-08-01",0.51335,{"date":416,"score":100,"percentile":417},"2026-08-02",0.5134,{"date":419,"score":100,"percentile":420},"2026-08-03",0.51351,{"date":422,"score":100,"percentile":423},"2026-08-04",0.51369,{"date":425,"score":100,"percentile":426},"2026-08-05",0.51399,[428,432,435,437,439,441],{"source":110,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":429,"cvss_v4_0":9},{"baseScore":102,"baseSeverity":9,"vectorString":105,"impactScore":430,"exploitabilityScore":431},9.8,7.2,{"source":104,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":433,"cvss_v4_0":9},{"baseScore":102,"baseSeverity":434,"vectorString":105,"impactScore":430,"exploitabilityScore":431},"HIGH",{"source":111,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":436,"cvss_v4_0":9},{"baseScore":102,"baseSeverity":434,"vectorString":105,"impactScore":430,"exploitabilityScore":431},{"source":141,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":438,"cvss_v4_0":9},{"baseScore":102,"baseSeverity":9,"vectorString":105,"impactScore":430,"exploitabilityScore":431},{"source":112,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":440,"cvss_v4_0":9},{"baseScore":102,"baseSeverity":9,"vectorString":105,"impactScore":430,"exploitabilityScore":431},{"source":113,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":442,"cvss_v4_0":9},{"baseScore":102,"baseSeverity":9,"vectorString":105,"impactScore":430,"exploitabilityScore":431},[444,456,462,468,477,481,487,496,501,505,509,522,533,539],{"ecosystem":445,"name":446,"vendor":447,"product":446,"cpe_part":9,"purl_type":448,"purl_namespace":447,"purl_name":446,"source":9,"versions":449},"Chainguard","awx","chainguard","apk",[450],{"version":451,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":454,"version_end_type":455,"fixed_in":9},"lt24_6_1_r35",true,"ecosystem","24.6.1-r35","excluding",{"ecosystem":445,"name":457,"vendor":447,"product":457,"cpe_part":9,"purl_type":448,"purl_namespace":447,"purl_name":457,"source":9,"versions":458},"checkov",[459],{"version":460,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":461,"version_end_type":455,"fixed_in":9},"lt3_2_525_r0","3.2.525-r0",{"ecosystem":445,"name":463,"vendor":447,"product":463,"cpe_part":9,"purl_type":448,"purl_namespace":447,"purl_name":463,"source":9,"versions":464},"datahub-ingestion-fips",[465],{"version":466,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":467,"version_end_type":455,"fixed_in":9},"lt1_5_0_1_r2","1.5.0.1-r2",{"ecosystem":445,"name":469,"vendor":447,"product":469,"cpe_part":9,"purl_type":448,"purl_namespace":447,"purl_name":469,"source":9,"versions":470},"mlflow",[471,474],{"version":472,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":473,"version_end_type":455,"fixed_in":9},"lt3_11_1_r0","3.11.1-r0",{"version":475,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":476,"version_end_type":455,"fixed_in":9},"lt3_16_0_r0","3.16.0-r0",{"ecosystem":445,"name":478,"vendor":447,"product":478,"cpe_part":9,"purl_type":448,"purl_namespace":447,"purl_name":478,"source":9,"versions":479},"mlflow-fips",[480],{"version":472,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":473,"version_end_type":455,"fixed_in":9},{"ecosystem":445,"name":482,"vendor":447,"product":482,"cpe_part":9,"purl_type":448,"purl_namespace":447,"purl_name":482,"source":9,"versions":483},"opal",[484],{"version":485,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":486,"version_end_type":455,"fixed_in":9},"lt0_9_5_r0","0.9.5-r0",{"ecosystem":445,"name":488,"vendor":447,"product":488,"cpe_part":9,"purl_type":448,"purl_namespace":447,"purl_name":488,"source":9,"versions":489},"open-webui",[490,493],{"version":491,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":492,"version_end_type":455,"fixed_in":9},"lt0_8_12_r4","0.8.12-r4",{"version":494,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":495,"version_end_type":455,"fixed_in":9},"lt0_9_2_r0","0.9.2-r0",{"ecosystem":497,"name":457,"vendor":498,"product":457,"cpe_part":9,"purl_type":448,"purl_namespace":498,"purl_name":457,"source":9,"versions":499},"Wolfi","wolfi",[500],{"version":460,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":461,"version_end_type":455,"fixed_in":9},{"ecosystem":497,"name":469,"vendor":498,"product":469,"cpe_part":9,"purl_type":448,"purl_namespace":498,"purl_name":469,"source":9,"versions":502},[503,504],{"version":472,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":473,"version_end_type":455,"fixed_in":9},{"version":475,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":476,"version_end_type":455,"fixed_in":9},{"ecosystem":497,"name":488,"vendor":498,"product":488,"cpe_part":9,"purl_type":448,"purl_namespace":498,"purl_name":488,"source":9,"versions":506},[507,508],{"version":491,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":492,"version_end_type":455,"fixed_in":9},{"version":494,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":495,"version_end_type":455,"fixed_in":9},{"ecosystem":510,"name":511,"vendor":512,"product":511,"cpe_part":9,"purl_type":513,"purl_namespace":512,"purl_name":511,"source":9,"versions":514},"Debian","python-git","debian","deb",[515,517,518,519],{"version":516,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",{"version":516,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":516,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":520,"is_range":452,"range_type":453,"version_start":9,"version_start_type":9,"version_end":521,"version_end_type":455,"fixed_in":9},"lt3_1_50_1","3.1.50-1",{"ecosystem":9,"name":523,"vendor":524,"product":523,"cpe_part":525,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":526},"gitpython","gitpython_project","a",[527],{"version":528,"is_range":452,"range_type":529,"version_start":530,"version_start_type":531,"version_end":532,"version_end_type":455,"fixed_in":9},"gte3.1.30_lt3.1.47","cpe","3.1.30","including","3.1.47",{"ecosystem":9,"name":534,"vendor":535,"product":523,"cpe_part":525,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":536},"GitPython","gitpython-developers",[537],{"version":538,"is_range":452,"range_type":104,"version_start":530,"version_start_type":531,"version_end":532,"version_end_type":455,"fixed_in":9},">= 3.1.30, \u003C 3.1.47",{"ecosystem":540,"name":523,"vendor":540,"product":523,"cpe_part":9,"purl_type":541,"purl_namespace":9,"purl_name":523,"source":9,"versions":542},"PyPI","pypi",[543],{"version":544,"is_range":452,"range_type":453,"version_start":530,"version_start_type":531,"version_end":532,"version_end_type":455,"fixed_in":9},"gte3_1_30_lt3_1_47"]