Security update for python-GitPython
This update for python-GitPython fixes the following issues - CVE-2026-42215: command injection via Git options bypass (bsc#1264604). - CVE-2026-42284: unsafe option check validates multi_options before shlex.split transforms it (bsc#1264605). - CVE-2026-44243: path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository (bsc#1264606). - CVE-2026-44244: newline injection in config_writer().set_value() enables RCE via core.hooksPath (bsc#1264608).
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for python-GitPython fixes the following issues - CVE-2026-42215: command injection via Git options bypass (bsc#1264604). - CVE-2026-42284: unsafe option check validates multi_options before shlex.split transforms it (bsc#1264605). - CVE-2026-44243: path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository (bsc#1264606). - CVE-2026-44244: newline injection in config_writer().set_value() enables RCE via core.hooksPath (bsc#1264608).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1264604
- https://bugzilla.suse.com/1264605
- https://bugzilla.suse.com/1264606
- https://bugzilla.suse.com/1264608
- https://www.suse.com/security/cve/CVE-2026-42215
- https://www.suse.com/security/cve/CVE-2026-42284
- https://www.suse.com/security/cve/CVE-2026-44243
- https://www.suse.com/security/cve/CVE-2026-44244