[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-MGASA-2026-0372":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":20,"duplicates":21,"related":22,"reserved_at":9,"published_at":23,"modified_at":24,"state":9,"summary":25,"references_raw":27,"kevs":124,"epss":9,"epss_history":125,"metrics":126,"affected":127},"MGASA-2026-0372","Updated python-gitpython packages fix security vulnerabilities\n\nCVE-2023-40267 GitPython before 3.1.32 does not block insecure non-multi\noptions in clone and clone_from. NOTE: this issue exists because of an\nincomplete fix for CVE-2022-24439.\nCVE-2023-41040 In order to resolve some git references, GitPython reads\nfiles from the `.git` directory, in some places the name of the file\nbeing read is provided by the user, GitPython doesn't check if this file\nis located outside the `.git` directory. This allows an attacker to make\nGitPython read any file from the system.\nCVE-2026-42215 From version 3.1.30 to before version 3.1.47, GitPython\nblocks dangerous Git options such as --upload-pack and --receive-pack by\ndefault, but the equivalent Python kwargs upload_pack and receive_pack\nbypass that check. If an application passes attacker-controlled kwargs\ninto Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(),\nthis leads to arbitrary command execution even when allow_unsafe_options\nis left at its default value of False. This issue has been patched in\nversion 3.1.47.\n",null,[],[],[],[14,16,18],{"_key":15},"CVE-2023-40267",{"_key":17},"CVE-2023-41040",{"_key":19},"CVE-2026-42215",[],[],[],"2026-09-03T18:06:14Z","2026-09-03T18:15:02.938994693Z",{"cisa_kev":26,"cisa_ransomware":26,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[28,34,39,44,48,52,56,60,64,68,72,76,80,84,88,92,96,100,104,108,112,116,120],{"url":29,"sources":30,"tags":32},"https://advisories.mageia.org/MGASA-2026-0372.html",[31],"osv_mageia",[33],"Advisory",{"url":35,"sources":36,"tags":37},"https://bugs.mageia.org/show_bug.cgi?id=35535",[31],[38],"REPORT",{"url":40,"sources":41,"tags":42},"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/",[31],[43],"WEB",{"url":45,"sources":46,"tags":47},"https://lists.debian.org/debian-lts-announce/2023/09/msg00036.html",[31],[43],{"url":49,"sources":50,"tags":51},"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4",[31],[33],{"url":53,"sources":54,"tags":55},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.50",[31],[43],{"url":57,"sources":58,"tags":59},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49",[31],[43],{"url":61,"sources":62,"tags":63},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48",[31],[43],{"url":65,"sources":66,"tags":67},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47",[31],[43],{"url":69,"sources":70,"tags":71},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.46",[31],[43],{"url":73,"sources":74,"tags":75},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.45",[31],[43],{"url":77,"sources":78,"tags":79},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.44",[31],[43],{"url":81,"sources":82,"tags":83},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.43",[31],[43],{"url":85,"sources":86,"tags":87},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.42",[31],[43],{"url":89,"sources":90,"tags":91},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.41",[31],[43],{"url":93,"sources":94,"tags":95},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.40",[31],[43],{"url":97,"sources":98,"tags":99},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.38",[31],[43],{"url":101,"sources":102,"tags":103},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.37",[31],[43],{"url":105,"sources":106,"tags":107},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.35",[31],[43],{"url":109,"sources":110,"tags":111},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.34",[31],[43],{"url":113,"sources":114,"tags":115},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.33",[31],[43],{"url":117,"sources":118,"tags":119},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.32",[31],[43],{"url":121,"sources":122,"tags":123},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.31",[31],[43],[],[],[],[128],{"ecosystem":129,"name":130,"vendor":131,"product":130,"cpe_part":9,"purl_type":132,"purl_namespace":131,"purl_name":130,"source":9,"versions":133},"Mageia","python-gitpython","mageia","rpm",[134],{"version":135,"is_range":136,"range_type":137,"version_start":9,"version_start_type":9,"version_end":138,"version_end_type":139,"fixed_in":9},"lt3_1_50_1_mga9",true,"ecosystem","3.1.50-1.mga9","excluding"]