gitpython 3.1.62
PkgFire would install this release with a warning.·Checked 1 hour ago·Published 7 September 2026
Why
-
warnVulnerability
GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679) (fixed in 3.2.0)
-
warnVulnerability
GitPython validates a submodule's ".git" path only after cloning into it (RCE) (fixed in 3.2.1)
-
warnVulnerability
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution (fixed in 3.2.0)
-
warnVulnerability
GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name (fixed in 3.2.0)
-
warnVulnerability
GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree (fixed in 3.2.0)
-
warnVulnerability
GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines (fixed in 3.2.0)
-
warnVulnerability
GitPython command wrappers omit unsafe protocol and option checks (fixed in 3.2.0)
Provenance
A registry signature proves the registry served these bytes unaltered. Build provenance proves which workflow built them from which commit; a stolen publishing token can fake the first but not the second.
- Signature
- Not signed
- Build provenance
- None, and no earlier version had any
What the code does
On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.
Code reading
PkgFire's own reading of the files: what the code can do.
Source patterns
Patterns found in the source, including those malware is known to use.
Other checked releases
Check every dependency before it installs
This page is one release. PkgFire checks every package in your lockfile, on every install and in every pull request, and blocks the bad ones before they run.