NIXPKGS-2026-2348

GitHub issue published 1 month, 1 week ago

Popt-devel: popt-static: off-by-one in poptstuffargs

Permalink CVE-2026-18739

2.5 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  12 packages

  • ipopt
  • poptop
  • poptracker
  • scipopt-ug
  • scipopt-gcg
  • scipopt-scip
  • scipopt-zimpl
  • scipopt-papilo
  • scipopt-soplex
  • pkgsRocm.scipopt-ug
  • python313Packages.cyipopt
  • python314Packages.cyipopt
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Popt-devel: popt-static: off-by-one in poptstuffargs

• https://access.redhat.com/security/cve/CVE-2026-18739 x_refsource_REDHATvdb-entry
• RHBZ#2510737 x_refsource_REDHATissue-tracking

---

popt

rhcos

Apparently no published fix yet (2026-08-05)

NIXPKGS-2026-2347

GitHub issue published 1 month, 1 week ago

Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr

Permalink CVE-2026-68742

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  2 packages

  • python313Packages.aliyun-python-sdk-osssddp
  • python314Packages.aliyun-python-sdk-osssddp
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr

• https://access.redhat.com/security/cve/CVE-2026-68742 x_refsource_REDHATvdb-entry
• RHBZ#2509762 x_refsource_REDHATissue-tracking

---

sssd

rhcos

NIXPKGS-2026-2346

GitHub issue published 1 month, 1 week ago

PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Permalink CVE-2026-69153

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

• https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp exploitx_refsource_CONFIRM
• https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8 x_refsource_MISC
• https://github.com/postcss/postcss/releases/tag/8.5.19 x_refsource_MISC

---

postcss

• ==< 8.5.19

NIXPKGS-2026-2345

GitHub issue published 1 month, 1 week ago

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

Permalink CVE-2026-48061

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  2 packages

  • python313Packages.litestar-htmx
  • python314Packages.litestar-htmx
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

• https://github.com/litestar-org/litestar/security/advisories/GHSA-3qmc-cj7q-62hv x_refsource_CONFIRM
• https://github.com/litestar-org/litestar/commit/6930a20ceb543912cd651b42deae5b9f3637a262 x_refsource_MISC

---

litestar

• ==< 2.22.0

NIXPKGS-2026-2344

GitHub issue published 1 month, 1 week ago

GitPython before 3.1.53 Config Injection via Submodule Names

Permalink CVE-2026-69097

7.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

GitPython before 3.1.53 Config Injection via Submodule Names

• GitHub Security Advisory (GHSA-3rp5-jjmw-4wv2) vendor-advisoryexploit
• VulnCheck Advisory: GitPython before 3.1.53 Config Injection via Submodule Names third-party-advisory

---

GitPython

• <3.1.53
• ==3.1.53

NIXPKGS-2026-2343

GitHub issue published 1 month, 1 week ago

python3Packages.cryptography: security issues < 49.0.0 (backport needed)

Permalink CVE-2026-69248

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  8 packages

  • python313Packages.mypy-boto3-payment-cryptography
  • python314Packages.mypy-boto3-payment-cryptography
  • python313Packages.mypy-boto3-payment-cryptography-data
  • python314Packages.mypy-boto3-payment-cryptography-data
  • python313Packages.types-aiobotocore-payment-cryptography
  • python314Packages.types-aiobotocore-payment-cryptography
  • python313Packages.types-aiobotocore-payment-cryptography-data
  • python314Packages.types-aiobotocore-payment-cryptography-data
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

• https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c x_refsource_CONFIRM
• https://github.com/pyca/cryptography/pull/14888 x_refsource_MISC
• https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2 x_refsource_MISC

---

cryptography

• ==< 49.0.0

Permalink CVE-2026-69249

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  8 packages

  • python313Packages.mypy-boto3-payment-cryptography
  • python314Packages.mypy-boto3-payment-cryptography
  • python313Packages.mypy-boto3-payment-cryptography-data
  • python314Packages.mypy-boto3-payment-cryptography-data
  • python313Packages.types-aiobotocore-payment-cryptography
  • python314Packages.types-aiobotocore-payment-cryptography
  • python313Packages.types-aiobotocore-payment-cryptography-data
  • python314Packages.types-aiobotocore-payment-cryptography-data
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

• https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww x_refsource_CONFIRM
• https://github.com/pyca/cryptography/pull/14960 x_refsource_MISC
• https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582 x_refsource_MISC

---

cryptography

• ==< 49.0.0

Permalink CVE-2026-69247

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  8 packages

  • python313Packages.mypy-boto3-payment-cryptography
  • python314Packages.mypy-boto3-payment-cryptography
  • python313Packages.mypy-boto3-payment-cryptography-data
  • python314Packages.mypy-boto3-payment-cryptography-data
  • python313Packages.types-aiobotocore-payment-cryptography
  • python314Packages.types-aiobotocore-payment-cryptography
  • python313Packages.types-aiobotocore-payment-cryptography-data
  • python314Packages.types-aiobotocore-payment-cryptography-data
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

• https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5 x_refsource_CONFIRM
• https://github.com/pyca/cryptography/pull/15369 x_refsource_MISC
• https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f x_refsource_MISC

---

cryptography

• ==>= 44.0.0, < 50.0.0

NIXPKGS-2026-2342

GitHub issue published 1 month, 1 week ago

PyAthena 3.35.4 SQL Injection via DefaultParameterFormatter DELETE/CTAS

Permalink CVE-2026-65321

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

PyAthena 3.35.4 SQL Injection via DefaultParameterFormatter DELETE/CTAS

• Product Repository product
• GitHub Security Advisory vendor-advisory
• Patch Commit patch
• https://www.vulncheck.com/advisories/pyathena-sql-injection-via-defaultparamete… third-party-advisory

---

PyAthena

• =<3.35.3

NIXPKGS-2026-2341

GitHub issue published 1 month, 1 week ago

GitPython before 3.1.50 Newline Injection via config_writer section

Permalink CVE-2026-67326

7.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored maintainer @fabaff 1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

GitPython before 3.1.50 Newline Injection via config_writer section

• GitHub Security Advisory (GHSA-mv93-w799-cj2w) vendor-advisory
• VulnCheck Advisory: GitPython before 3.1.50 Newline Injection via config_writer section third-party-advisory

---

GitPython

• ==3.1.50
• <3.1.50

NIXPKGS-2026-2340

GitHub issue published 1 month, 1 week ago

gitpython: security issues < 3.1.51 (needs backport)

Permalink CVE-2026-67324

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

GitPython 3.1.50 Authentication Bypass via Joined Short Options

• GitHub Security Advisory (GHSA-v396-v7q4-x2qj) vendor-advisory
• VulnCheck Advisory: GitPython 3.1.50 Authentication Bypass via Joined Short Options third-party-advisory

---

GitPython

• ==3.1.51
• <3.1.51

Permalink CVE-2026-67323

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

GitPython before 3.1.51 Command Injection via unguarded Git options

• GitHub Security Advisory (GHSA-956x-8gvw-wg5v) vendor-advisory
• VulnCheck Advisory: GitPython before 3.1.51 Command Injection via unguarded Git options third-party-advisory

---

GitPython

• ==3.1.51
• <3.1.51

Permalink CVE-2026-67325

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

GitPython before 3.1.51 Command Injection via option prefix abbreviation

• GitHub Security Advisory (GHSA-2f96-g7mh-g2hx) vendor-advisory
• VulnCheck Advisory: GitPython before 3.1.51 Command Injection via option prefix abbreviation third-party-advisory

---

GitPython

• <3.1.51
• ==3.1.51

NIXPKGS-2026-2339

GitHub issue published 1 month, 1 week ago

GitPython before 3.1.52 Environment Variable Exfiltration via clone_from

Permalink CVE-2026-67322

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

GitPython before 3.1.52 Environment Variable Exfiltration via clone_from

• GitHub Security Advisory (GHSA-rwj8-pgh3-r573) vendor-advisory
• VulnCheck Advisory: GitPython before 3.1.52 Environment Variable Exfiltration via clone_from third-party-advisory

---

GitPython

• <3.1.52
• ==3.1.52