python3Packages.gitpython

GHSA-239g-whfq-7xj9 high EPSS 0.4% GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution (OSV, for this version)

GHSA-284h-m62q-gf8w critical EPSS 0.8% GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE (OSV, for this version)

GHSA-3wxw-xv34-2frg medium EPSS 0.3% GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251) (OSV, for this version)

GHSA-59cr-6r3x-644w high 8.7 EPSS 0.4% GitPython submodule update path traversal can write outside the repository (OSV, for this version)

GHSA-5xxx-qhh7-9287 medium EPSS 0.4% GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame() (OSV, for this version)

GHSA-7833-fr7j-v32q high EPSS 0.2% GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes) (OSV, for this version)

GHSA-8mcc-hrx5-hvxc high EPSS 0.7% GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination (OSV, for this version)

GHSA-g5vv-9gxw-82hx high EPSS 0.5% GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing (OSV, for this version)