[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-42284":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":39,"aliases":57,"duplicate_of":9,"upstream":77,"downstream":78,"duplicates":92,"related":93,"reserved_at":9,"published_at":97,"modified_at":98,"state":99,"summary":100,"references_raw":108,"kevs":152,"epss":153,"epss_history":156,"metrics":431,"affected":450},"CVE-2026-42284","GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(\" \".join(multi_options)). A string like \"--branch main --config core.hooksPath=/x\" passes validation (starts with --branch), but after split becomes [\"--branch\", \"main\", \"--config\", \"core.hooksPath=/x\"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-88","Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')","The product constructs a string for a command to be executed by a separate component\nin another control sphere, but it does not properly delimit the\nintended arguments, options, or switches within that command string.","weakness","Draft","Base",[19,23,27,31,35],{"id":20,"name":21,"techniques":22},"CAPEC-137","Parameter Injection",[],{"id":24,"name":25,"techniques":26},"CAPEC-174","Flash Parameter Injection",[],{"id":28,"name":29,"techniques":30},"CAPEC-41","Using Meta-characters in E-mail Headers to Inject Malicious Payloads",[],{"id":32,"name":33,"techniques":34},"CAPEC-460","HTTP Parameter Pollution (HPP)",[],{"id":36,"name":37,"techniques":38},"CAPEC-88","OS Command Injection",[],[40,49],{"_key":41,"name":42,"source":43,"url":44,"maturity":45,"reliability_score":46,"verified":47,"type":9,"platforms":48,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_GITPYTHON-DEVELOPERS_GITPYTHON","Gitpython","github","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4","poc",0.3,false,[],{"_key":50,"name":51,"source":52,"url":53,"maturity":54,"reliability_score":55,"verified":47,"type":9,"platforms":56,"requires_auth":9,"exploitdb":9,"metasploit":9},"REF_0ACB3C13BAF72ADD","Exploit Reference (tenable.com)","reference","https://www.tenable.com/cve/CVE-2026-32686","unknown",0.2,[],[58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76],"GHSA-x2qx-6953-8485","PYSEC-2026-2161","DEBIAN-CVE-2026-42284","CGA-cc97-58fg-6c3g","CGA-frq7-825g-vrh5","CGA-fv32-jf2q-4347","CGA-ggx3-5xq5-g9gf","CGA-ph7h-gphc-xghf","CGA-36c4-p8rc-349m","CGA-3rq3-f7qf-pxg3","CGA-43jf-5fxh-8vcq","CGA-4455-vcw2-h55p","CGA-733j-xhq8-fgxj","CGA-9qm7-mx6c-p456","CGA-wh3r-466r-3mg4","CGA-wpj6-7wgf-6qf7","CGA-x7cc-g84g-r77m","CGA-2cwf-9xhc-gxmm","CGA-6h52-prf6-29hr",[],[79,81,83,84,86,88,90],{"_key":80},"UBUNTU-CVE-2026-42284",{"_key":82},"USN-8303-1",{"_key":60},{"_key":85},"SUSE-SU-2026:4072-1",{"_key":87},"RHSA-2026:42078",{"_key":89},"RHSA-2026:42079",{"_key":91},"RHSA-2026:63385",[],[94,95],{"_key":85},{"_key":96},"CGA-8PR5-GMQ5-XW9J","2026-05-07T18:19:20.129Z","2026-05-09T03:56:02.927Z","Modified",{"cisa_kev":47,"cisa_ransomware":47,"cisa_vendor":9,"epss_severity":101,"epss_score":102,"severity":103,"severity_score":104,"severity_version":105,"severity_source":106,"severity_vector":107,"severity_status":99},"low",0.00571,"critical",9.8,"v3.1","nvd","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",[109,123,128,136,139,143,148],{"url":110,"sources":111,"tags":116},"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485",[112,113,106,114,115],"osv_pypi","cve.org","osv_wolfi","osv_chainguard",[117,118,119,120,121,122],"WEB","X Refsource CONFIRM","Exploit","Vendor Advisory","EVIDENCE","Advisory",{"url":124,"sources":125,"tags":126},"https://github.com/gitpython-developers/GitPython",[112],[127],"PACKAGE",{"url":129,"sources":130,"tags":131},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47",[113,106,112,114,115],[132,133,134,117,135],"X Refsource MISC","Patch","Release Notes","FIX",{"url":53,"sources":137,"tags":138},[113,106,112,114,115],[119,117,121],{"url":140,"sources":141,"tags":142},"https://nvd.nist.gov/vuln/detail/CVE-2026-42284",[112,114,115],[122],{"url":144,"sources":145,"tags":147},"https://security-tracker.debian.org/tracker/CVE-2026-42284",[146],"osv_debian",[122],{"url":149,"sources":150,"tags":151},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42284.json",[114,115],[122],[],{"date":154,"score":102,"percentile":155},"2026-09-19",0.4598,[157,161,165,168,171,174,178,181,184,187,189,192,195,198,201,205,208,211,214,217,220,223,226,229,232,235,238,241,244,247,250,253,257,260,263,266,269,272,275,278,281,284,287,290,293,296,299,302,305,308,311,314,317,320,323,326,329,332,335,338,341,344,347,350,353,356,359,362,365,368,371,374,377,380,383,386,389,392,395,398,401,404,407,410,413,416,419,422,425,428],{"date":158,"score":159,"percentile":160},"2026-05-08",0.00047,0.14323,{"date":162,"score":163,"percentile":164},"2026-05-09",0.00044,0.13502,{"date":166,"score":163,"percentile":167},"2026-05-10",0.13501,{"date":169,"score":163,"percentile":170},"2026-05-11",0.13494,{"date":172,"score":163,"percentile":173},"2026-05-12",0.13524,{"date":175,"score":176,"percentile":177},"2026-05-13",0.00058,0.18108,{"date":179,"score":176,"percentile":180},"2026-05-14",0.18151,{"date":182,"score":176,"percentile":183},"2026-05-15",0.1816,{"date":185,"score":176,"percentile":186},"2026-05-16",0.1817,{"date":188,"score":176,"percentile":180},"2026-05-17",{"date":190,"score":176,"percentile":191},"2026-05-18",0.18106,{"date":193,"score":176,"percentile":194},"2026-05-19",0.18094,{"date":196,"score":176,"percentile":197},"2026-05-20",0.18105,{"date":199,"score":176,"percentile":200},"2026-05-21",0.18086,{"date":202,"score":203,"percentile":204},"2026-05-22",0.00021,0.06069,{"date":206,"score":203,"percentile":207},"2026-05-23",0.06062,{"date":209,"score":203,"percentile":210},"2026-05-24",0.0606,{"date":212,"score":203,"percentile":213},"2026-05-25",0.06042,{"date":215,"score":203,"percentile":216},"2026-05-26",0.06022,{"date":218,"score":203,"percentile":219},"2026-05-27",0.06053,{"date":221,"score":203,"percentile":222},"2026-05-28",0.06133,{"date":224,"score":203,"percentile":225},"2026-05-29",0.06148,{"date":227,"score":203,"percentile":228},"2026-05-30",0.06138,{"date":230,"score":203,"percentile":231},"2026-05-31",0.06125,{"date":233,"score":203,"percentile":234},"2026-06-01",0.06076,{"date":236,"score":203,"percentile":237},"2026-06-02",0.05991,{"date":239,"score":203,"percentile":240},"2026-06-03",0.05947,{"date":242,"score":203,"percentile":243},"2026-06-04",0.05948,{"date":245,"score":203,"percentile":246},"2026-06-05",0.05969,{"date":248,"score":203,"percentile":249},"2026-06-06",0.05961,{"date":251,"score":203,"percentile":252},"2026-06-07",0.05958,{"date":254,"score":255,"percentile":256},"2026-06-08",0.00022,0.06545,{"date":258,"score":255,"percentile":259},"2026-06-09",0.06548,{"date":261,"score":255,"percentile":262},"2026-06-10",0.06577,{"date":264,"score":255,"percentile":265},"2026-06-11",0.06581,{"date":267,"score":255,"percentile":268},"2026-06-12",0.06604,{"date":270,"score":255,"percentile":271},"2026-06-13",0.06593,{"date":273,"score":255,"percentile":274},"2026-06-14",0.06575,{"date":276,"score":102,"percentile":277},"2026-06-15",0.4254,{"date":279,"score":102,"percentile":280},"2026-06-16",0.42594,{"date":282,"score":102,"percentile":283},"2026-06-17",0.42674,{"date":285,"score":102,"percentile":286},"2026-06-18",0.42718,{"date":288,"score":102,"percentile":289},"2026-06-19",0.42704,{"date":291,"score":102,"percentile":292},"2026-06-20",0.42699,{"date":294,"score":102,"percentile":295},"2026-06-21",0.42684,{"date":297,"score":102,"percentile":298},"2026-06-22",0.42678,{"date":300,"score":102,"percentile":301},"2026-06-23",0.4276,{"date":303,"score":102,"percentile":304},"2026-06-24",0.42799,{"date":306,"score":102,"percentile":307},"2026-06-25",0.42878,{"date":309,"score":102,"percentile":310},"2026-06-26",0.42917,{"date":312,"score":102,"percentile":313},"2026-06-27",0.42957,{"date":315,"score":102,"percentile":316},"2026-06-28",0.4295,{"date":318,"score":102,"percentile":319},"2026-06-29",0.42954,{"date":321,"score":102,"percentile":322},"2026-06-30",0.42926,{"date":324,"score":102,"percentile":325},"2026-07-01",0.43015,{"date":327,"score":102,"percentile":328},"2026-07-02",0.4305,{"date":330,"score":102,"percentile":331},"2026-07-03",0.43067,{"date":333,"score":102,"percentile":334},"2026-07-04",0.43091,{"date":336,"score":102,"percentile":337},"2026-07-05",0.43108,{"date":339,"score":102,"percentile":340},"2026-07-06",0.43118,{"date":342,"score":102,"percentile":343},"2026-07-07",0.43129,{"date":345,"score":102,"percentile":346},"2026-07-08",0.43142,{"date":348,"score":102,"percentile":349},"2026-07-09",0.432,{"date":351,"score":102,"percentile":352},"2026-07-10",0.43231,{"date":354,"score":102,"percentile":355},"2026-07-11",0.43266,{"date":357,"score":102,"percentile":358},"2026-07-12",0.43263,{"date":360,"score":102,"percentile":361},"2026-07-13",0.43295,{"date":363,"score":102,"percentile":364},"2026-07-14",0.43306,{"date":366,"score":102,"percentile":367},"2026-07-15",0.43392,{"date":369,"score":102,"percentile":370},"2026-07-16",0.43425,{"date":372,"score":102,"percentile":373},"2026-07-17",0.43443,{"date":375,"score":102,"percentile":376},"2026-07-18",0.43452,{"date":378,"score":102,"percentile":379},"2026-07-19",0.43454,{"date":381,"score":102,"percentile":382},"2026-07-20",0.43518,{"date":384,"score":102,"percentile":385},"2026-07-21",0.43541,{"date":387,"score":102,"percentile":388},"2026-07-22",0.43752,{"date":390,"score":102,"percentile":391},"2026-07-23",0.43772,{"date":393,"score":102,"percentile":394},"2026-07-24",0.43785,{"date":396,"score":102,"percentile":397},"2026-07-25",0.43837,{"date":399,"score":102,"percentile":400},"2026-07-26",0.43829,{"date":402,"score":102,"percentile":403},"2026-07-27",0.43823,{"date":405,"score":102,"percentile":406},"2026-07-28",0.43878,{"date":408,"score":102,"percentile":409},"2026-07-29",0.43905,{"date":411,"score":102,"percentile":412},"2026-07-30",0.43985,{"date":414,"score":102,"percentile":415},"2026-07-31",0.44013,{"date":417,"score":102,"percentile":418},"2026-08-01",0.44022,{"date":420,"score":102,"percentile":421},"2026-08-02",0.44027,{"date":423,"score":102,"percentile":424},"2026-08-03",0.44036,{"date":426,"score":102,"percentile":427},"2026-08-04",0.44021,{"date":429,"score":102,"percentile":430},"2026-08-05",0.44016,[432,437,440,444,446,448],{"source":112,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":433,"cvss_v4_0":9},{"baseScore":434,"baseSeverity":9,"vectorString":435,"impactScore":104,"exploitabilityScore":436},8.1,"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",5.6,{"source":113,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":438,"cvss_v4_0":9},{"baseScore":434,"baseSeverity":439,"vectorString":435,"impactScore":104,"exploitabilityScore":436},"HIGH",{"source":106,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":441,"cvss_v4_0":9},{"baseScore":104,"baseSeverity":442,"vectorString":107,"impactScore":104,"exploitabilityScore":443},"CRITICAL",10,{"source":146,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":445,"cvss_v4_0":9},{"baseScore":104,"baseSeverity":9,"vectorString":107,"impactScore":104,"exploitabilityScore":443},{"source":114,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":447,"cvss_v4_0":9},{"baseScore":434,"baseSeverity":9,"vectorString":435,"impactScore":104,"exploitabilityScore":436},{"source":115,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":449,"cvss_v4_0":9},{"baseScore":434,"baseSeverity":9,"vectorString":435,"impactScore":104,"exploitabilityScore":436},[451,463,469,475,484,488,494,503,508,512,516,529,538,544],{"ecosystem":452,"name":453,"vendor":454,"product":453,"cpe_part":9,"purl_type":455,"purl_namespace":454,"purl_name":453,"source":9,"versions":456},"Chainguard","awx","chainguard","apk",[457],{"version":458,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":461,"version_end_type":462,"fixed_in":9},"lt24_6_1_r35",true,"ecosystem","24.6.1-r35","excluding",{"ecosystem":452,"name":464,"vendor":454,"product":464,"cpe_part":9,"purl_type":455,"purl_namespace":454,"purl_name":464,"source":9,"versions":465},"checkov",[466],{"version":467,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":468,"version_end_type":462,"fixed_in":9},"lt3_2_525_r0","3.2.525-r0",{"ecosystem":452,"name":470,"vendor":454,"product":470,"cpe_part":9,"purl_type":455,"purl_namespace":454,"purl_name":470,"source":9,"versions":471},"datahub-ingestion-fips",[472],{"version":473,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":474,"version_end_type":462,"fixed_in":9},"lt1_5_0_1_r2","1.5.0.1-r2",{"ecosystem":452,"name":476,"vendor":454,"product":476,"cpe_part":9,"purl_type":455,"purl_namespace":454,"purl_name":476,"source":9,"versions":477},"mlflow",[478,481],{"version":479,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":480,"version_end_type":462,"fixed_in":9},"lt3_11_1_r0","3.11.1-r0",{"version":482,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":483,"version_end_type":462,"fixed_in":9},"lt3_16_0_r0","3.16.0-r0",{"ecosystem":452,"name":485,"vendor":454,"product":485,"cpe_part":9,"purl_type":455,"purl_namespace":454,"purl_name":485,"source":9,"versions":486},"mlflow-fips",[487],{"version":479,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":480,"version_end_type":462,"fixed_in":9},{"ecosystem":452,"name":489,"vendor":454,"product":489,"cpe_part":9,"purl_type":455,"purl_namespace":454,"purl_name":489,"source":9,"versions":490},"opal",[491],{"version":492,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":493,"version_end_type":462,"fixed_in":9},"lt0_9_5_r0","0.9.5-r0",{"ecosystem":452,"name":495,"vendor":454,"product":495,"cpe_part":9,"purl_type":455,"purl_namespace":454,"purl_name":495,"source":9,"versions":496},"open-webui",[497,500],{"version":498,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":499,"version_end_type":462,"fixed_in":9},"lt0_8_12_r4","0.8.12-r4",{"version":501,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":502,"version_end_type":462,"fixed_in":9},"lt0_9_2_r0","0.9.2-r0",{"ecosystem":504,"name":464,"vendor":505,"product":464,"cpe_part":9,"purl_type":455,"purl_namespace":505,"purl_name":464,"source":9,"versions":506},"Wolfi","wolfi",[507],{"version":467,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":468,"version_end_type":462,"fixed_in":9},{"ecosystem":504,"name":476,"vendor":505,"product":476,"cpe_part":9,"purl_type":455,"purl_namespace":505,"purl_name":476,"source":9,"versions":509},[510,511],{"version":479,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":480,"version_end_type":462,"fixed_in":9},{"version":482,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":483,"version_end_type":462,"fixed_in":9},{"ecosystem":504,"name":495,"vendor":505,"product":495,"cpe_part":9,"purl_type":455,"purl_namespace":505,"purl_name":495,"source":9,"versions":513},[514,515],{"version":498,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":499,"version_end_type":462,"fixed_in":9},{"version":501,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":502,"version_end_type":462,"fixed_in":9},{"ecosystem":517,"name":518,"vendor":519,"product":518,"cpe_part":9,"purl_type":520,"purl_namespace":519,"purl_name":518,"source":9,"versions":521},"Debian","python-git","debian","deb",[522,524,525,526],{"version":523,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",{"version":523,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":523,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":527,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":528,"version_end_type":462,"fixed_in":9},"lt3_1_50_1","3.1.50-1",{"ecosystem":9,"name":530,"vendor":531,"product":530,"cpe_part":532,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":533},"gitpython","gitpython_project","a",[534],{"version":535,"is_range":459,"range_type":536,"version_start":9,"version_start_type":9,"version_end":537,"version_end_type":462,"fixed_in":9},"lt3.1.47","cpe","3.1.47",{"ecosystem":9,"name":539,"vendor":540,"product":530,"cpe_part":532,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":541},"GitPython","gitpython-developers",[542],{"version":543,"is_range":459,"range_type":113,"version_start":9,"version_start_type":9,"version_end":537,"version_end_type":462,"fixed_in":9},"\u003C 3.1.47",{"ecosystem":545,"name":530,"vendor":545,"product":530,"cpe_part":9,"purl_type":546,"purl_namespace":9,"purl_name":530,"source":9,"versions":547},"PyPI","pypi",[548],{"version":549,"is_range":459,"range_type":460,"version_start":9,"version_start_type":9,"version_end":537,"version_end_type":462,"fixed_in":9},"lt3_1_47"]