{"matches":[{"vulnerability":{"id":"GHSA-mrrh-fwg8-r2c3","dataSource":"https://github.com/advisories/GHSA-mrrh-fwg8-r2c3","namespace":"github:language:github-action","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-30066","https://github.com/tj-actions/changed-files/issues/2463","https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193","https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised","https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised","https://github.com/chains-project/maven-lockfile/pull/1111","https://github.com/rackerlabs/genestack/pull/903","https://news.ycombinator.com/item?id=43367987","https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463","https://github.com/espressif/arduino-esp32/issues/11127","https://github.com/modal-labs/modal-examples/issues/1100","https://github.com/tj-actions/changed-files/issues/2464","https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28","https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066","https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066","https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack","https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond","https://github.com/tj-actions/changed-files/issues/2477","https://github.com/tj-actions/changed-files/releases/tag/v46.0.1","https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066","https://blog.gitguardian.com/compromised-tj-actions","https://github.com/tj-actions/changed-files/security/advisories/GHSA-mw4p-6x4p-x5m5","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066","https://news.ycombinator.com/item?id=43368870"],"description":"tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:H","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2025-30066","vendorProject":"tj-actions","product":"changed-files GitHub Action","dateAdded":"2025-03-18","requiredAction":"Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-04-08","knownRansomwareCampaignUse":"unknown","notes":"This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction; Additional References: https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-30066"],"cwes":["CWE-506"]}],"epss":[{"cve":"CVE-2025-30066","epss":0.72092,"percentile":0.99431,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-30066","cwe":"CWE-506","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-30066","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["46.0.1"],"state":"fixed","available":[{"version":"46.0.1","date":"2025-09-04","kind":"first-observed"}]},"advisories":[],"risk":84.52499999999999},"relatedVulnerabilities":[{"id":"CVE-2025-30066","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-30066","namespace":"nvd:cpe","severity":"High","urls":["https://blog.gitguardian.com/compromised-tj-actions/","https://github.com/chains-project/maven-lockfile/pull/1111","https://github.com/espressif/arduino-esp32/issues/11127","https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193","https://github.com/modal-labs/modal-examples/issues/1100","https://github.com/rackerlabs/genestack/pull/903","https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28","https://github.com/tj-actions/changed-files/issues/2463","https://github.com/tj-actions/changed-files/issues/2464","https://github.com/tj-actions/changed-files/issues/2477","https://news.ycombinator.com/item?id=43367987","https://news.ycombinator.com/item?id=43368870","https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/","https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/","https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463","https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised","https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond","https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack","https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066","https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066"],"description":"tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2025-30066","vendorProject":"tj-actions","product":"changed-files GitHub Action","dateAdded":"2025-03-18","requiredAction":"Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-04-08","knownRansomwareCampaignUse":"unknown","notes":"This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction; Additional References: https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-30066"],"cwes":["CWE-506"]}],"epss":[{"cve":"CVE-2025-30066","epss":0.72092,"percentile":0.99431,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-30066","cwe":"CWE-506","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-30066","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"tj-actions/changed-files","version":"v44"}},"found":{"vulnerabilityID":"GHSA-mrrh-fwg8-r2c3","versionConstraint":"<=45.0.7 (unknown)"},"fix":{"suggestedVersion":"46.0.1"}}],"artifact":{"id":"pkg:github/tj-actions/changed-files@v44?package-id=7c809c6a8b1e2c30","name":"tj-actions/changed-files","version":"v44","type":"github-action","locations":[{"path":"/.github/workflows/pr-test.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:tj-actions\\/changed-files:tj-actions\\/changed-files:v44:*:*:*:*:*:*:*","cpe:2.3:a:tj-actions\\/changed-files:tj_actions\\/changed_files:v44:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/changed_files:tj-actions\\/changed-files:v44:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/changed_files:tj_actions\\/changed_files:v44:*:*:*:*:*:*:*","cpe:2.3:a:tj-actions\\/changed:tj-actions\\/changed-files:v44:*:*:*:*:*:*:*","cpe:2.3:a:tj-actions\\/changed:tj_actions\\/changed_files:v44:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/changed:tj-actions\\/changed-files:v44:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/changed:tj_actions\\/changed_files:v44:*:*:*:*:*:*:*","cpe:2.3:a:tj:tj-actions\\/changed-files:v44:*:*:*:*:*:*:*","cpe:2.3:a:tj:tj_actions\\/changed_files:v44:*:*:*:*:*:*:*"],"purl":"pkg:github/tj-actions/changed-files@v44","upstreams":[]}},{"vulnerability":{"id":"GHSA-38jv-5279-wg99","dataSource":"https://github.com/advisories/GHSA-38jv-5279-wg99","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99","https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b","https://nvd.nist.gov/vuln/detail/CVE-2026-21441","https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"],"description":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21441","epss":0.02922,"percentile":0.87044,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-21441","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-21441","cwe":"CWE-409","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["2.6.3"],"state":"fixed","available":[{"version":"2.6.3","date":"2026-01-08","kind":"first-observed"}]},"advisories":[],"risk":2.29377},"relatedVulnerabilities":[{"id":"CVE-2026-21441","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21441","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b","https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99","https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html","https://access.redhat.com/errata/RHSA-2026:0981","https://access.redhat.com/errata/RHSA-2026:0990","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:1038","https://access.redhat.com/errata/RHSA-2026:1041","https://access.redhat.com/errata/RHSA-2026:1042","https://access.redhat.com/errata/RHSA-2026:1086","https://access.redhat.com/errata/RHSA-2026:1087","https://access.redhat.com/errata/RHSA-2026:1088","https://access.redhat.com/errata/RHSA-2026:1089","https://access.redhat.com/errata/RHSA-2026:1166","https://access.redhat.com/errata/RHSA-2026:1168","https://access.redhat.com/errata/RHSA-2026:1176","https://access.redhat.com/errata/RHSA-2026:1224","https://access.redhat.com/errata/RHSA-2026:1226","https://access.redhat.com/errata/RHSA-2026:1239","https://access.redhat.com/errata/RHSA-2026:1240","https://access.redhat.com/errata/RHSA-2026:1241","https://access.redhat.com/errata/RHSA-2026:1254","https://access.redhat.com/errata/RHSA-2026:1485","https://access.redhat.com/errata/RHSA-2026:14877","https://access.redhat.com/errata/RHSA-2026:1504","https://access.redhat.com/errata/RHSA-2026:1546","https://access.redhat.com/errata/RHSA-2026:1596","https://access.redhat.com/errata/RHSA-2026:1599","https://access.redhat.com/errata/RHSA-2026:1609","https://access.redhat.com/errata/RHSA-2026:1618","https://access.redhat.com/errata/RHSA-2026:1619","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:1674","https://access.redhat.com/errata/RHSA-2026:1676","https://access.redhat.com/errata/RHSA-2026:1693","https://access.redhat.com/errata/RHSA-2026:1704","https://access.redhat.com/errata/RHSA-2026:1706","https://access.redhat.com/errata/RHSA-2026:1712","https://access.redhat.com/errata/RHSA-2026:1717","https://access.redhat.com/errata/RHSA-2026:1726","https://access.redhat.com/errata/RHSA-2026:1729","https://access.redhat.com/errata/RHSA-2026:1730","https://access.redhat.com/errata/RHSA-2026:1734","https://access.redhat.com/errata/RHSA-2026:1735","https://access.redhat.com/errata/RHSA-2026:1736","https://access.redhat.com/errata/RHSA-2026:17456","https://access.redhat.com/errata/RHSA-2026:17457","https://access.redhat.com/errata/RHSA-2026:17460","https://access.redhat.com/errata/RHSA-2026:17461","https://access.redhat.com/errata/RHSA-2026:17462","https://access.redhat.com/errata/RHSA-2026:17463","https://access.redhat.com/errata/RHSA-2026:1791","https://access.redhat.com/errata/RHSA-2026:1792","https://access.redhat.com/errata/RHSA-2026:1793","https://access.redhat.com/errata/RHSA-2026:1794","https://access.redhat.com/errata/RHSA-2026:1803","https://access.redhat.com/errata/RHSA-2026:1805","https://access.redhat.com/errata/RHSA-2026:1942","https://access.redhat.com/errata/RHSA-2026:1957","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:2106","https://access.redhat.com/errata/RHSA-2026:2126","https://access.redhat.com/errata/RHSA-2026:2137","https://access.redhat.com/errata/RHSA-2026:2139","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2256","https://access.redhat.com/errata/RHSA-2026:2456","https://access.redhat.com/errata/RHSA-2026:2500","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:2563","https://access.redhat.com/errata/RHSA-2026:2681","https://access.redhat.com/errata/RHSA-2026:2695","https://access.redhat.com/errata/RHSA-2026:2717","https://access.redhat.com/errata/RHSA-2026:2718","https://access.redhat.com/errata/RHSA-2026:2723","https://access.redhat.com/errata/RHSA-2026:2728","https://access.redhat.com/errata/RHSA-2026:2760","https://access.redhat.com/errata/RHSA-2026:2762","https://access.redhat.com/errata/RHSA-2026:2764","https://access.redhat.com/errata/RHSA-2026:2765","https://access.redhat.com/errata/RHSA-2026:28043","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2911","https://access.redhat.com/errata/RHSA-2026:2919","https://access.redhat.com/errata/RHSA-2026:2924","https://access.redhat.com/errata/RHSA-2026:2925","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:3296","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:3406","https://access.redhat.com/errata/RHSA-2026:3444","https://access.redhat.com/errata/RHSA-2026:3461","https://access.redhat.com/errata/RHSA-2026:3462","https://access.redhat.com/errata/RHSA-2026:3713","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:4185","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:4215","https://access.redhat.com/errata/RHSA-2026:4271","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:44696","https://access.redhat.com/errata/RHSA-2026:51357","https://access.redhat.com/errata/RHSA-2026:5459","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:6287","https://access.redhat.com/errata/RHSA-2026:6292","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8500","https://access.redhat.com/errata/RHSA-2026:8501","https://access.redhat.com/security/cve/CVE-2026-21441","https://bugzilla.redhat.com/show_bug.cgi?id=2427726","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21441.json"],"description":"urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21441","epss":0.02922,"percentile":0.87044,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-21441","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-21441","cwe":"CWE-409","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"1.26.20"}},"found":{"vulnerabilityID":"GHSA-38jv-5279-wg99","versionConstraint":">=1.22,<2.6.3 (python)"},"fix":{"suggestedVersion":"2.6.3"}}],"artifact":{"id":"pkg:pypi/urllib3@1.26.20?package-id=89915b9d94ed6e06","name":"urllib3","version":"1.26.20","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:1.26.20:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@1.26.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-ghm2-rq8q-wrhc","dataSource":"https://github.com/advisories/GHSA-ghm2-rq8q-wrhc","namespace":"github:language:github-action","severity":"High","urls":["https://github.com/tj-actions/verify-changed-files/security/advisories/GHSA-ghm2-rq8q-wrhc","https://nvd.nist.gov/vuln/detail/CVE-2023-52137","https://github.com/tj-actions/verify-changed-files/commit/498d3f316f501aa72485060e8c96fde7b2014f12","https://github.com/tj-actions/verify-changed-files/commit/592e305da041c09a009afa4a43c97d889bed65c3"],"description":"Potential Actions command injection in output filenames (GHSL-2023-275)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","metrics":{"baseScore":7.7,"exploitabilityScore":1.8,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-52137","epss":0.02621,"percentile":0.85463,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-52137","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-52137","cwe":"CWE-77","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["17"],"state":"fixed","available":[{"version":"17","date":"2025-09-04","kind":"first-observed"}]},"advisories":[],"risk":1.99196},"relatedVulnerabilities":[{"id":"CVE-2023-52137","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52137","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/tj-actions/verify-changed-files/commit/498d3f316f501aa72485060e8c96fde7b2014f12","https://github.com/tj-actions/verify-changed-files/commit/592e305da041c09a009afa4a43c97d889bed65c3","https://github.com/tj-actions/verify-changed-files/security/advisories/GHSA-ghm2-rq8q-wrhc"],"description":"The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The [`verify-changed-files`](https://github.com/tj-actions/verify-changed-files) workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as `;` which can be used by an attacker to take over the [GitHub Runner](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners) if the output value is used in a raw fashion (thus being directly replaced before execution) inside a `run` block. By running custom commands, an attacker may be able to steal secrets such as `GITHUB_TOKEN` if triggered on other events than `pull_request`.\n\nThis has been patched in versions [17](https://github.com/tj-actions/verify-changed-files/releases/tag/v17) and [17.0.0](https://github.com/tj-actions/verify-changed-files/releases/tag/v17.0.0) by enabling `safe_output` by default and returning filename paths escaping special characters for bash environments.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","metrics":{"baseScore":7.7,"exploitabilityScore":1.8,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-52137","epss":0.02621,"percentile":0.85463,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-52137","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-52137","cwe":"CWE-77","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"tj-actions/verify-changed-files","version":"v13"}},"found":{"vulnerabilityID":"GHSA-ghm2-rq8q-wrhc","versionConstraint":"<17 (unknown)"},"fix":{"suggestedVersion":"17"}}],"artifact":{"id":"pkg:github/tj-actions/verify-changed-files@v13?package-id=ded53590aa728d38","name":"tj-actions/verify-changed-files","version":"v13","type":"github-action","locations":[{"path":"/.github/workflows/codeql-analysis.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:tj-actions\\/verify-changed-files:tj-actions\\/verify-changed-files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj-actions\\/verify-changed-files:tj_actions\\/verify_changed_files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/verify_changed_files:tj-actions\\/verify-changed-files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/verify_changed_files:tj_actions\\/verify_changed_files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj-actions\\/verify-changed:tj-actions\\/verify-changed-files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj-actions\\/verify-changed:tj_actions\\/verify_changed_files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/verify_changed:tj-actions\\/verify-changed-files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/verify_changed:tj_actions\\/verify_changed_files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj-actions\\/verify:tj-actions\\/verify-changed-files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj-actions\\/verify:tj_actions\\/verify_changed_files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/verify:tj-actions\\/verify-changed-files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/verify:tj_actions\\/verify_changed_files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj:tj-actions\\/verify-changed-files:v13:*:*:*:*:*:*:*","cpe:2.3:a:tj:tj_actions\\/verify_changed_files:v13:*:*:*:*:*:*:*"],"purl":"pkg:github/tj-actions/verify-changed-files@v13","upstreams":[]}},{"vulnerability":{"id":"GHSA-2f96-g7mh-g2hx","dataSource":"https://github.com/advisories/GHSA-2f96-g7mh-g2hx","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx","https://github.com/gitpython-developers/GitPython/pull/2161","https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51","https://nvd.nist.gov/vuln/detail/CVE-2026-67325","https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation"],"description":"GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67325","epss":0.02209,"percentile":0.82594,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67325","cwe":"CWE-78","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.51"],"state":"fixed","available":[{"version":"3.1.51","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":1.800335},"relatedVulnerabilities":[{"id":"CVE-2026-67325","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx","https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation"],"description":"GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67325","epss":0.02209,"percentile":0.82594,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67325","cwe":"CWE-78","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-2f96-g7mh-g2hx","versionConstraint":"<=3.1.50 (python)"},"fix":{"suggestedVersion":"3.1.51"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-956x-8gvw-wg5v","dataSource":"https://github.com/advisories/GHSA-956x-8gvw-wg5v","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v","https://github.com/gitpython-developers/GitPython/pull/2163","https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51","https://nvd.nist.gov/vuln/detail/CVE-2026-67323","https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options"],"description":"GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67323","epss":0.01251,"percentile":0.69421,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67323","cwe":"CWE-77","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.51"],"state":"fixed","available":[{"version":"3.1.51","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.9945450000000001},"relatedVulnerabilities":[{"id":"CVE-2026-67323","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67323","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v","https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options"],"description":"GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67323","epss":0.01251,"percentile":0.69421,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67323","cwe":"CWE-77","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-956x-8gvw-wg5v","versionConstraint":"<=3.1.50 (python)"},"fix":{"suggestedVersion":"3.1.51"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-wj6h-64fc-37mp","dataSource":"https://github.com/advisories/GHSA-wj6h-64fc-37mp","namespace":"github:language:python","severity":"High","urls":["https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp","https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md","https://nvd.nist.gov/vuln/detail/CVE-2024-23342","https://minerva.crocs.fi.muni.cz","https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python"],"description":"Minerva timing attack on P-256 in python-ecdsa","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-23342","epss":0.00977,"percentile":0.62153,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-23342","cwe":"CWE-203","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-23342","cwe":"CWE-208","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-23342","cwe":"CWE-385","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.727865},"relatedVulnerabilities":[{"id":"CVE-2024-23342","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-23342","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md","https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp","https://minerva.crocs.fi.muni.cz/","https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/"],"description":"The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-23342","epss":0.00977,"percentile":0.62153,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-23342","cwe":"CWE-203","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-23342","cwe":"CWE-208","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-23342","cwe":"CWE-385","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"ecdsa","version":"0.19.2"}},"found":{"vulnerabilityID":"GHSA-wj6h-64fc-37mp","versionConstraint":">=0 (python)"}}],"artifact":{"id":"pkg:pypi/ecdsa@0.19.2?package-id=58788d6290d1eb08","name":"ecdsa","version":"0.19.2","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:tlsfuzzer:ecdsa:0.19.2:*:*:*:*:python:*:*"],"purl":"pkg:pypi/ecdsa@0.19.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rpm5-65cw-6hj4","dataSource":"https://github.com/advisories/GHSA-rpm5-65cw-6hj4","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4","https://nvd.nist.gov/vuln/detail/CVE-2026-42215","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47"],"description":"GitPython has Command Injection via Git options bypass","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42215","epss":0.00749,"percentile":0.54925,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42215","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.47"],"state":"fixed","available":[{"version":"3.1.47","date":"2026-04-26","kind":"first-observed"}]},"advisories":[],"risk":0.6104350000000001},"relatedVulnerabilities":[{"id":"CVE-2026-42215","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42215","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4"],"description":"GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42215","epss":0.00749,"percentile":0.54925,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42215","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-rpm5-65cw-6hj4","versionConstraint":">=3.1.30,<3.1.47 (python)"},"fix":{"suggestedVersion":"3.1.47"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-2xpw-w6gg-jr37","dataSource":"https://github.com/advisories/GHSA-2xpw-w6gg-jr37","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37","https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7","https://nvd.nist.gov/vuln/detail/CVE-2025-66471","https://github.com/urllib3/urllib3/commit/d0fde3672e4a4093f7587858dccfc298eb66e46c","https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-1994.yaml","https://github.com/urllib3/urllib3","https://pypi.org/project/urllib3"],"description":"urllib3 streaming API improperly handles highly compressed data","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-66471","epss":0.00682,"percentile":0.52479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-66471","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.0"],"state":"fixed","available":[{"version":"2.6.0","date":"2025-12-06","kind":"first-observed"}]},"advisories":[],"risk":0.55924},"relatedVulnerabilities":[{"id":"CVE-2025-66471","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66471","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7","https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"],"description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-66471","epss":0.00682,"percentile":0.52479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-66471","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"1.26.20"}},"found":{"vulnerabilityID":"GHSA-2xpw-w6gg-jr37","versionConstraint":">=1.0,<2.6.0 (python)"},"fix":{"suggestedVersion":"2.6.0"}}],"artifact":{"id":"pkg:pypi/urllib3@1.26.20?package-id=89915b9d94ed6e06","name":"urllib3","version":"1.26.20","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:1.26.20:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@1.26.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-gm62-xv2j-4w53","dataSource":"https://github.com/advisories/GHSA-gm62-xv2j-4w53","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53","https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8","https://nvd.nist.gov/vuln/detail/CVE-2025-66418"],"description":"urllib3 allows an unbounded number of links in the decompression chain","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-66418","epss":0.00682,"percentile":0.52479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-66418","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.0"],"state":"fixed","available":[{"version":"2.6.0","date":"2025-12-06","kind":"first-observed"}]},"advisories":[],"risk":0.55924},"relatedVulnerabilities":[{"id":"CVE-2025-66418","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8","https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"],"description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-66418","epss":0.00682,"percentile":0.52479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-66418","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"1.26.20"}},"found":{"vulnerabilityID":"GHSA-gm62-xv2j-4w53","versionConstraint":">=1.24,<2.6.0 (python)"},"fix":{"suggestedVersion":"2.6.0"}}],"artifact":{"id":"pkg:pypi/urllib3@1.26.20?package-id=89915b9d94ed6e06","name":"urllib3","version":"1.26.20","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:1.26.20:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@1.26.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-9rj7-rf2p-w77r","dataSource":"https://github.com/advisories/GHSA-9rj7-rf2p-w77r","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r","https://github.com/gitpython-developers/GitPython/pull/2204","https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58","https://nvd.nist.gov/vuln/detail/CVE-2026-76218","https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init"],"description":"GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76218","epss":0.0072,"percentile":0.53934,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76218","cwe":"CWE-88","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.58"],"state":"fixed","available":[{"version":"3.1.58","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.54},"relatedVulnerabilities":[{"id":"CVE-2026-76218","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76218","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r","https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init"],"description":"GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76218","epss":0.0072,"percentile":0.53934,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76218","cwe":"CWE-88","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-9rj7-rf2p-w77r","versionConstraint":"<=3.1.57 (python)"},"fix":{"suggestedVersion":"3.1.58"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-284h-m62q-gf8w","dataSource":"https://github.com/advisories/GHSA-284h-m62q-gf8w","namespace":"github:language:python","severity":"Critical","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w","https://nvd.nist.gov/vuln/detail/CVE-2026-78676","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3786.yaml","https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection"],"description":"GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78676","epss":0.00556,"percentile":0.46386,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78676","cwe":"CWE-88","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.59"],"state":"fixed","available":[{"version":"3.1.59","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.51569},"relatedVulnerabilities":[{"id":"CVE-2026-78676","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78676","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w","https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection"],"description":"GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78676","epss":0.00556,"percentile":0.46386,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78676","cwe":"CWE-88","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-284h-m62q-gf8w","versionConstraint":"<=3.1.58 (python)"},"fix":{"suggestedVersion":"3.1.59"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-8mcc-hrx5-hvxc","dataSource":"https://github.com/advisories/GHSA-8mcc-hrx5-hvxc","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc","https://nvd.nist.gov/vuln/detail/CVE-2026-78677","https://github.com/gitpython-developers/GitPython/pull/2210","https://github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3787.yaml","https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir"],"description":"GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78677","epss":0.00651,"percentile":0.51223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78677","cwe":"CWE-22","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.59"],"state":"fixed","available":[{"version":"3.1.59","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.50778},"relatedVulnerabilities":[{"id":"CVE-2026-78677","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78677","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc","https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir"],"description":"GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, enabling arbitrary directory creation and potential hook execution.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78677","epss":0.00651,"percentile":0.51223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78677","cwe":"CWE-22","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-8mcc-hrx5-hvxc","versionConstraint":"<=3.1.58 (python)"},"fix":{"suggestedVersion":"3.1.59"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-hx9q-6w63-j58v","dataSource":"https://github.com/advisories/GHSA-hx9q-6w63-j58v","namespace":"github:language:python","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-67221","https://github.com/ijl/orjson","https://github.com/kpatsakis/orjson_vulnerability","https://github.com/ijl/orjson/issues/620","https://github.com/kpatsakis/CVE-2025-67221/issues/1","https://github.com/ijl/orjson/commit/62bb185b70785ded49c79c26f8c9781f1e6fe370","https://github.com/pypa/advisory-database/tree/main/vulns/orjson/PYSEC-2026-107.yaml"],"description":"orjson does not limit recursion for deeply nested JSON documents","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-67221","epss":0.00633,"percentile":0.50361,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-67221","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["3.11.6"],"state":"fixed","available":[{"version":"3.11.6","date":"2026-03-13","kind":"first-observed"}]},"advisories":[],"risk":0.48107999999999995},"relatedVulnerabilities":[{"id":"CVE-2025-67221","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-67221","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ijl/orjson","https://github.com/kpatsakis/orjson_vulnerability"],"description":"The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-67221","epss":0.00633,"percentile":0.50361,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-67221","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"orjson","version":"3.11.5"}},"found":{"vulnerabilityID":"GHSA-hx9q-6w63-j58v","versionConstraint":"<3.11.6 (python)"},"fix":{"suggestedVersion":"3.11.6"}}],"artifact":{"id":"pkg:pypi/orjson@3.11.5?package-id=08be8870ef4eec1a","name":"orjson","version":"3.11.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-orjson:python-orjson:3.11.5:*:*:*:*:*:*:*","cpe:2.3:a:python-orjson:python_orjson:3.11.5:*:*:*:*:*:*:*","cpe:2.3:a:python_orjson:python-orjson:3.11.5:*:*:*:*:*:*:*","cpe:2.3:a:python_orjson:python_orjson:3.11.5:*:*:*:*:*:*:*","cpe:2.3:a:orjson:python-orjson:3.11.5:*:*:*:*:*:*:*","cpe:2.3:a:orjson:python_orjson:3.11.5:*:*:*:*:*:*:*","cpe:2.3:a:python-orjson:orjson:3.11.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-orjson:3.11.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_orjson:3.11.5:*:*:*:*:*:*:*","cpe:2.3:a:python_orjson:orjson:3.11.5:*:*:*:*:*:*:*","cpe:2.3:a:orjson:orjson:3.11.5:*:*:*:*:*:*:*","cpe:2.3:a:python:orjson:3.11.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/orjson@3.11.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-wvpp-8hx9-p66j","dataSource":"https://github.com/advisories/GHSA-wvpp-8hx9-p66j","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j","https://github.com/gitpython-developers/GitPython/pull/2204","https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58","https://nvd.nist.gov/vuln/detail/CVE-2026-76220","https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options"],"description":"GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76220","epss":0.0059,"percentile":0.48249,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76220","cwe":"CWE-88","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.58"],"state":"fixed","available":[{"version":"3.1.58","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.48085},"relatedVulnerabilities":[{"id":"CVE-2026-76220","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76220","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j","https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options"],"description":"GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76220","epss":0.0059,"percentile":0.48249,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76220","cwe":"CWE-88","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-wvpp-8hx9-p66j","versionConstraint":"<=3.1.57 (python)"},"fix":{"suggestedVersion":"3.1.58"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-x2qx-6953-8485","dataSource":"https://github.com/advisories/GHSA-x2qx-6953-8485","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485","https://nvd.nist.gov/vuln/detail/CVE-2026-42284","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","https://www.tenable.com/cve/CVE-2026-32686"],"description":"GitPython: Unsafe option check validates multi_options before shlex.split transformation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42284","epss":0.00571,"percentile":0.4727,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42284","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.47"],"state":"fixed","available":[{"version":"3.1.47","date":"2026-04-26","kind":"first-observed"}]},"advisories":[],"risk":0.44538},"relatedVulnerabilities":[{"id":"CVE-2026-42284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42284","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485","https://www.tenable.com/cve/CVE-2026-32686"],"description":"GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(\" \".join(multi_options)). A string like \"--branch main --config core.hooksPath=/x\" passes validation (starts with --branch), but after split becomes [\"--branch\", \"main\", \"--config\", \"core.hooksPath=/x\"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42284","epss":0.00571,"percentile":0.4727,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42284","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-x2qx-6953-8485","versionConstraint":"<3.1.47 (python)"},"fix":{"suggestedVersion":"3.1.47"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-4gmw-gg2m-w46p","dataSource":"https://github.com/advisories/GHSA-4gmw-gg2m-w46p","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p","https://github.com/gitpython-developers/GitPython/pull/2204","https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58","https://nvd.nist.gov/vuln/detail/CVE-2026-76219","https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree"],"description":"GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76219","epss":0.00543,"percentile":0.4564,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76219","cwe":"CWE-88","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.58"],"state":"fixed","available":[{"version":"3.1.58","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.42354},"relatedVulnerabilities":[{"id":"CVE-2026-76219","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76219","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p","https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree"],"description":"GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76219","epss":0.00543,"percentile":0.4564,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76219","cwe":"CWE-88","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-4gmw-gg2m-w46p","versionConstraint":"<=3.1.57 (python)"},"fix":{"suggestedVersion":"3.1.58"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-g5vv-9gxw-82hx","dataSource":"https://github.com/advisories/GHSA-g5vv-9gxw-82hx","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx","https://github.com/gitpython-developers/GitPython/pull/2215","https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3984.yaml","https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos"],"description":"GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87819","epss":0.00521,"percentile":0.44266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87819","cwe":"CWE-1333","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.60"],"state":"fixed","available":[{"version":"3.1.60","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.39075000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-87819","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87819","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx","https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos"],"description":"GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87819","epss":0.00521,"percentile":0.44266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87819","cwe":"CWE-1333","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-g5vv-9gxw-82hx","versionConstraint":"<=3.1.59 (python)"},"fix":{"suggestedVersion":"3.1.60"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-g5vv-9gxw-82hx","dataSource":"https://github.com/advisories/GHSA-g5vv-9gxw-82hx","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx","https://github.com/gitpython-developers/GitPython/pull/2215","https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3984.yaml","https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos"],"description":"GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87819","epss":0.00521,"percentile":0.44266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87819","cwe":"CWE-1333","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.60"],"state":"fixed","available":[{"version":"3.1.60","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.39075000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-87819","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87819","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx","https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos"],"description":"GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87819","epss":0.00521,"percentile":0.44266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87819","cwe":"CWE-1333","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.59"}},"found":{"vulnerabilityID":"GHSA-g5vv-9gxw-82hx","versionConstraint":"<=3.1.59 (python)"},"fix":{"suggestedVersion":"3.1.60"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.59?package-id=c4d193d5eddc05f4","name":"gitpython","version":"3.1.59","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.59:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.59","upstreams":[]}},{"vulnerability":{"id":"GHSA-cq5v-8q36-5273","dataSource":"https://github.com/advisories/GHSA-cq5v-8q36-5273","namespace":"github:language:python","severity":"High","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273","https://github.com/aio-libs/aiohttp/pull/13223","https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3"],"description":"AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69244","epss":0.00528,"percentile":0.44711,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69244","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69244","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69244","cwe":"CWE-416","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.3"],"state":"fixed","available":[{"version":"3.14.3","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.38544},"relatedVulnerabilities":[{"id":"CVE-2026-69244","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69244","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d","https://github.com/aio-libs/aiohttp/pull/13223","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69244","epss":0.00528,"percentile":0.44711,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69244","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69244","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69244","cwe":"CWE-416","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-cq5v-8q36-5273","versionConstraint":"<=3.14.2 (python)"},"fix":{"suggestedVersion":"3.14.3"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-239g-whfq-7xj9","dataSource":"https://github.com/advisories/GHSA-239g-whfq-7xj9","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9","https://nvd.nist.gov/vuln/detail/CVE-2026-87817","https://github.com/gitpython-developers/GitPython/pull/2218","https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3982.yaml","https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation"],"description":"GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87817","epss":0.00419,"percentile":0.36257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87817","cwe":"CWE-94","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.60"],"state":"fixed","available":[{"version":"3.1.60","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.34148500000000004},"relatedVulnerabilities":[{"id":"CVE-2026-87817","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87817","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9","https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation"],"description":"GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87817","epss":0.00419,"percentile":0.36257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87817","cwe":"CWE-94","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-239g-whfq-7xj9","versionConstraint":"<=3.1.59 (python)"},"fix":{"suggestedVersion":"3.1.60"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-239g-whfq-7xj9","dataSource":"https://github.com/advisories/GHSA-239g-whfq-7xj9","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9","https://nvd.nist.gov/vuln/detail/CVE-2026-87817","https://github.com/gitpython-developers/GitPython/pull/2218","https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3982.yaml","https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation"],"description":"GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87817","epss":0.00419,"percentile":0.36257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87817","cwe":"CWE-94","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.60"],"state":"fixed","available":[{"version":"3.1.60","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.34148500000000004},"relatedVulnerabilities":[{"id":"CVE-2026-87817","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87817","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9","https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation"],"description":"GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87817","epss":0.00419,"percentile":0.36257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87817","cwe":"CWE-94","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.59"}},"found":{"vulnerabilityID":"GHSA-239g-whfq-7xj9","versionConstraint":"<=3.1.59 (python)"},"fix":{"suggestedVersion":"3.1.60"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.59?package-id=c4d193d5eddc05f4","name":"gitpython","version":"3.1.59","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.59:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.59","upstreams":[]}},{"vulnerability":{"id":"GHSA-hmq2-w58f-27jc","dataSource":"https://github.com/advisories/GHSA-hmq2-w58f-27jc","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc","https://github.com/gitpython-developers/GitPython/pull/2202","https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c","https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58","https://nvd.nist.gov/vuln/detail/CVE-2026-76222","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3784.yaml","https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name"],"description":"GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76222","epss":0.00422,"percentile":0.36551,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76222","cwe":"CWE-22","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.58"],"state":"fixed","available":[{"version":"3.1.58","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.33126999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-76222","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76222","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc","https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name"],"description":"GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76222","epss":0.00422,"percentile":0.36551,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76222","cwe":"CWE-22","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-hmq2-w58f-27jc","versionConstraint":"<=3.1.57 (python)"},"fix":{"suggestedVersion":"3.1.58"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-63hw-fmq6-xxg2","dataSource":"https://github.com/advisories/GHSA-63hw-fmq6-xxg2","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2","https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d"],"description":"aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54277","epss":0.00563,"percentile":0.46832,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54277","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.1"],"state":"fixed","available":[{"version":"3.14.1","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.32653999999999994},"relatedVulnerabilities":[{"id":"CVE-2026-54277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54277","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54277","epss":0.00563,"percentile":0.46832,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54277","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-63hw-fmq6-xxg2","versionConstraint":"<=3.14.0 (python)"},"fix":{"suggestedVersion":"3.14.1"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-9xw5-w5jj-pvcg","dataSource":"https://github.com/advisories/GHSA-9xw5-w5jj-pvcg","namespace":"github:language:python","severity":"High","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg","https://nvd.nist.gov/vuln/detail/CVE-2026-111066","https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"],"description":"AIOHTTP: File descriptor exhaustion in multipart requests","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111066","epss":0.00412,"percentile":0.35441,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111066","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111066","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.4"],"state":"fixed","available":[{"version":"3.14.4","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.32342},"relatedVulnerabilities":[{"id":"CVE-2026-111066","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111066","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111066","epss":0.00412,"percentile":0.35441,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111066","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111066","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-9xw5-w5jj-pvcg","versionConstraint":">=2.0.0,<3.14.4 (python)"},"fix":{"suggestedVersion":"3.14.4"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-83vg-56qc-22m7","dataSource":"https://github.com/advisories/GHSA-83vg-56qc-22m7","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7","https://nvd.nist.gov/vuln/detail/CVE-2026-114145","https://github.com/gitpython-developers/GitPython/pull/2264","https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1"],"description":"GitPython validates a submodule's \".git\" path only after cloning into it (RCE)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114145","epss":0.00423,"percentile":0.36678,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114145","cwe":"CWE-696","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.2.1"],"state":"fixed","available":[{"version":"3.2.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.31725},"relatedVulnerabilities":[{"id":"CVE-2026-114145","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114145","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697","https://github.com/gitpython-developers/GitPython/pull/2264","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7"],"description":"GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the destination. In 3.1.x, _validate_repo_path() does not exist and the call succeeds silently, while in 3.2.0 and later affected revisions the check in git/index/base.py raises ValueError only after the clone has written to disk and does not remove the planted file. An attacker-controlled submodule can therefore place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination such as .git/hooks that is empty enough for Git to clone into it, which commonly means that default sample hooks are absent. This issue is fixed in version 3.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114145","epss":0.00423,"percentile":0.36678,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114145","cwe":"CWE-696","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-83vg-56qc-22m7","versionConstraint":"<=3.2.0 (python)"},"fix":{"suggestedVersion":"3.2.1"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-83vg-56qc-22m7","dataSource":"https://github.com/advisories/GHSA-83vg-56qc-22m7","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7","https://nvd.nist.gov/vuln/detail/CVE-2026-114145","https://github.com/gitpython-developers/GitPython/pull/2264","https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1"],"description":"GitPython validates a submodule's \".git\" path only after cloning into it (RCE)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114145","epss":0.00423,"percentile":0.36678,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114145","cwe":"CWE-696","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.2.1"],"state":"fixed","available":[{"version":"3.2.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.31725},"relatedVulnerabilities":[{"id":"CVE-2026-114145","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114145","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697","https://github.com/gitpython-developers/GitPython/pull/2264","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7"],"description":"GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the destination. In 3.1.x, _validate_repo_path() does not exist and the call succeeds silently, while in 3.2.0 and later affected revisions the check in git/index/base.py raises ValueError only after the clone has written to disk and does not remove the planted file. An attacker-controlled submodule can therefore place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination such as .git/hooks that is empty enough for Git to clone into it, which commonly means that default sample hooks are absent. This issue is fixed in version 3.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114145","epss":0.00423,"percentile":0.36678,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114145","cwe":"CWE-696","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.59"}},"found":{"vulnerabilityID":"GHSA-83vg-56qc-22m7","versionConstraint":"<=3.2.0 (python)"},"fix":{"suggestedVersion":"3.2.1"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.59?package-id=c4d193d5eddc05f4","name":"gitpython","version":"3.1.59","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.59:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.59","upstreams":[]}},{"vulnerability":{"id":"GHSA-gjv8-xp57-g29c","dataSource":"https://github.com/advisories/GHSA-gjv8-xp57-g29c","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c","https://nvd.nist.gov/vuln/detail/CVE-2026-86000","https://github.com/facelessuser/soupsieve/commit/ce44e4996e6632871c18cdd7a7fb641be8ef34ef","https://github.com/facelessuser/soupsieve/releases/tag/2.9"],"description":"Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86000","epss":0.00609,"percentile":0.4917,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86000","cwe":"CWE-400","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-86000","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["2.9.0"],"state":"fixed","available":[{"version":"2.9.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.313635},"relatedVulnerabilities":[{"id":"CVE-2026-86000","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86000","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/facelessuser/soupsieve/commit/ce44e4996e6632871c18cdd7a7fb641be8ef34ef","https://github.com/facelessuser/soupsieve/releases/tag/2.9","https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c"],"description":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an attacker-controlled selector contains a long identifier or unquoted attribute-value run followed by input that makes the overall match fail, the regular expression engine explores quadratically many splits between the overlapping groups. User-controlled selectors can reach this path through soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. The resulting CPU consumption can hold the Python GIL, exhaust application workers, and stall a service; successful plain identifier matches are linear, and the issue does not cause memory corruption or code execution. The issue is fixed in version 2.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86000","epss":0.00609,"percentile":0.4917,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86000","cwe":"CWE-400","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-86000","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"soupsieve","version":"2.8.4"}},"found":{"vulnerabilityID":"GHSA-gjv8-xp57-g29c","versionConstraint":"<2.9.0 (python)"},"fix":{"suggestedVersion":"2.9.0"}}],"artifact":{"id":"pkg:pypi/soupsieve@2.8.4?package-id=188aa839f1715692","name":"soupsieve","version":"2.8.4","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-soupsieve:python-soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python-soupsieve:python_soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:python-soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:python_soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python-soupsieve:soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:python-soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:python_soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python:python-soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python:python_soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python:soupsieve:2.8.4:*:*:*:*:*:*:*"],"purl":"pkg:pypi/soupsieve@2.8.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-j934-xhv5-fg8f","dataSource":"https://github.com/advisories/GHSA-j934-xhv5-fg8f","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f","https://nvd.nist.gov/vuln/detail/CVE-2026-85999","https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda","https://github.com/facelessuser/soupsieve/releases/tag/2.9"],"description":"Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85999","epss":0.00609,"percentile":0.4917,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85999","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-85999","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.9.0"],"state":"fixed","available":[{"version":"2.9.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.313635},"relatedVulnerabilities":[{"id":"CVE-2026-85999","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85999","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda","https://github.com/facelessuser/soupsieve/releases/tag/2.9","https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f"],"description":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC whitespace-and-comment expression used with search(), so the regular expression engine retries a greedy scan at every starting offset. An attacker-controlled valid selector containing a long internal whitespace run, or a selector containing a long CSS comment run followed by another token, causes quadratic CPU work before tokenization. User-controlled selectors can reach the path through soupsieve.compile() and BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. This root cause is separate from the IDENTIFIER and VALUE backtracking vulnerability because the cost occurs in RE_WS_END.search during trimming rather than token matching. The resulting CPU consumption can hold the Python GIL, exhaust workers, and stall a service without causing memory corruption or code execution. The issue is fixed in version 2.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85999","epss":0.00609,"percentile":0.4917,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85999","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-85999","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"soupsieve","version":"2.8.4"}},"found":{"vulnerabilityID":"GHSA-j934-xhv5-fg8f","versionConstraint":"<2.9.0 (python)"},"fix":{"suggestedVersion":"2.9.0"}}],"artifact":{"id":"pkg:pypi/soupsieve@2.8.4?package-id=188aa839f1715692","name":"soupsieve","version":"2.8.4","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-soupsieve:python-soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python-soupsieve:python_soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:python-soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:python_soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python-soupsieve:soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:python-soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:python_soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python:python-soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python:python_soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:soupsieve:2.8.4:*:*:*:*:*:*:*","cpe:2.3:a:python:soupsieve:2.8.4:*:*:*:*:*:*:*"],"purl":"pkg:pypi/soupsieve@2.8.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-5wr8-gcqf-gqf3","dataSource":"https://github.com/advisories/GHSA-5wr8-gcqf-gqf3","namespace":"github:language:python","severity":"High","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3","https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"],"description":"aiohttp server lacks an initial request/header timeout","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111064","epss":0.00399,"percentile":0.34185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111064","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.4"],"state":"fixed","available":[{"version":"3.14.4","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.3132149999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111064","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111064","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111064","epss":0.00399,"percentile":0.34185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111064","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-5wr8-gcqf-gqf3","versionConstraint":"<=3.14.3 (python)"},"fix":{"suggestedVersion":"3.14.4"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-7545-fcxq-7j24","dataSource":"https://github.com/advisories/GHSA-7545-fcxq-7j24","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24","https://nvd.nist.gov/vuln/detail/CVE-2026-44243","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48"],"description":"GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44243","epss":0.00419,"percentile":0.36271,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44243","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.48"],"state":"fixed","available":[{"version":"3.1.48","date":"2026-05-07","kind":"first-observed"}]},"advisories":[],"risk":0.31320249999999994},"relatedVulnerabilities":[{"id":"CVE-2026-44243","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44243","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24"],"description":"GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44243","epss":0.00419,"percentile":0.36271,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44243","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-7545-fcxq-7j24","versionConstraint":"<=3.1.47 (python)"},"fix":{"suggestedVersion":"3.1.48"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-xcgm-r5h9-7989","dataSource":"https://github.com/advisories/GHSA-xcgm-r5h9-7989","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989"],"description":"aiohttp: Incomplete websocket frame payloads bypass memory limits","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54274","epss":0.00539,"percentile":0.45395,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54274","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.1"],"state":"fixed","available":[{"version":"3.14.1","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.31261999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-54274","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54274","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54274","epss":0.00539,"percentile":0.45395,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54274","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-xcgm-r5h9-7989","versionConstraint":"<=3.14.0 (python)"},"fix":{"suggestedVersion":"3.14.1"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-mq44-7p77-q5h7","dataSource":"https://github.com/advisories/GHSA-mq44-7p77-q5h7","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7","https://nvd.nist.gov/vuln/detail/CVE-2026-59881","https://github.com/aio-libs/aiohttp/pull/12978","https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6","http://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"],"description":"AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59881","epss":0.00524,"percentile":0.44441,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59881","cwe":"CWE-20","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.14.2"],"state":"fixed","available":[{"version":"3.14.2","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.31177999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-59881","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59881","namespace":"nvd:cpe","severity":"Medium","urls":["http://github.com/aio-libs/aiohttp/releases/tag/v3.14.2","https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6","https://github.com/aio-libs/aiohttp/pull/12978","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59881","epss":0.00524,"percentile":0.44441,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59881","cwe":"CWE-20","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-mq44-7p77-q5h7","versionConstraint":"<=3.14.1 (python)"},"fix":{"suggestedVersion":"3.14.2"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-4fvr-rgm6-gqmc","dataSource":"https://github.com/advisories/GHSA-4fvr-rgm6-gqmc","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc","https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf"],"description":"aiohttp: HTTP/1 Pipelined Requests Queue Without Limit","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54273","epss":0.00493,"percentile":0.42384,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54273","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.1"],"state":"fixed","available":[{"version":"3.14.1","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.28594},"relatedVulnerabilities":[{"id":"CVE-2026-54273","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54273","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54273","epss":0.00493,"percentile":0.42384,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54273","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-4fvr-rgm6-gqmc","versionConstraint":"<=3.14.0 (python)"},"fix":{"suggestedVersion":"3.14.1"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3cq-j2xw-wf74","dataSource":"https://github.com/advisories/GHSA-g3cq-j2xw-wf74","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74"],"description":"aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54278","epss":0.00493,"percentile":0.42384,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54278","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.1"],"state":"fixed","available":[{"version":"3.14.1","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.28594},"relatedVulnerabilities":[{"id":"CVE-2026-54278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54278","epss":0.00493,"percentile":0.42384,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54278","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-g3cq-j2xw-wf74","versionConstraint":"<=3.14.0 (python)"},"fix":{"suggestedVersion":"3.14.1"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-vxq7-64xx-v4gw","dataSource":"https://github.com/advisories/GHSA-vxq7-64xx-v4gw","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97689","epss":0.00335,"percentile":0.26859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.27470000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-97689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"],"description":"urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97689","epss":0.00335,"percentile":0.26859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"1.26.20"}},"found":{"vulnerabilityID":"GHSA-vxq7-64xx-v4gw","versionConstraint":">=1.10.3,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@1.26.20?package-id=89915b9d94ed6e06","name":"urllib3","version":"1.26.20","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:1.26.20:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@1.26.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-mfx4-hv73-q22v","dataSource":"https://github.com/advisories/GHSA-mfx4-hv73-q22v","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v","https://github.com/aio-libs/aiohttp/pull/13017","https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"],"description":"AIOHTTP: HTTP request smuggling via WebSocket upgrade","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69243","epss":0.00443,"percentile":0.38528,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69243","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.2"],"state":"fixed","available":[{"version":"3.14.2","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.250295},"relatedVulnerabilities":[{"id":"CVE-2026-69243","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69243","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98","https://github.com/aio-libs/aiohttp/pull/13017","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69243","epss":0.00443,"percentile":0.38528,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69243","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-mfx4-hv73-q22v","versionConstraint":"<=3.14.1 (python)"},"fix":{"suggestedVersion":"3.14.2"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-rwj8-pgh3-r573","dataSource":"https://github.com/advisories/GHSA-rwj8-pgh3-r573","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573","https://github.com/gitpython-developers/GitPython/pull/2172","https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.52","https://nvd.nist.gov/vuln/detail/CVE-2026-67322","https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from","https://github.com/gitpython-developers/GitPython","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3842.yaml","https://pypi.org/project/gitpython"],"description":"GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67322","epss":0.00328,"percentile":0.25923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67322","cwe":"CWE-200","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.52"],"state":"fixed","available":[{"version":"3.1.52","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.246},"relatedVulnerabilities":[{"id":"CVE-2026-67322","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67322","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573","https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from"],"description":"GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN). The resulting URL, now containing the secret, is transmitted over the network to an attacker-controlled host during the clone attempt, disclosing the secret.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67322","epss":0.00328,"percentile":0.25923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67322","cwe":"CWE-200","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-rwj8-pgh3-r573","versionConstraint":"<3.1.52 (python)"},"fix":{"suggestedVersion":"3.1.52"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-pq67-6m6q-mj2v","dataSource":"https://github.com/advisories/GHSA-pq67-6m6q-mj2v","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v","https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857","https://nvd.nist.gov/vuln/detail/CVE-2025-50181","https://github.com/urllib3/urllib3/releases/tag/2.5.0"],"description":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-50181","epss":0.00474,"percentile":0.40995,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-50181","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.5.0"],"state":"fixed","available":[{"version":"2.5.0","date":"2025-06-19","kind":"first-observed"}]},"advisories":[],"risk":0.24411000000000002},"relatedVulnerabilities":[{"id":"CVE-2025-50181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857","https://github.com/urllib3/urllib3/releases/tag/2.5.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"],"description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-50181","epss":0.00474,"percentile":0.40995,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-50181","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"1.26.20"}},"found":{"vulnerabilityID":"GHSA-pq67-6m6q-mj2v","versionConstraint":"<2.5.0 (python)"},"fix":{"suggestedVersion":"2.5.0"}}],"artifact":{"id":"pkg:pypi/urllib3@1.26.20?package-id=89915b9d94ed6e06","name":"urllib3","version":"1.26.20","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:1.26.20:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@1.26.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-5xxx-qhh7-9287","dataSource":"https://github.com/advisories/GHSA-5xxx-qhh7-9287","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287","https://nvd.nist.gov/vuln/detail/CVE-2026-78678","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3788.yaml","https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-blame"],"description":"GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78678","epss":0.00412,"percentile":0.35469,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78678","cwe":"CWE-88","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.59"],"state":"fixed","available":[{"version":"3.1.59","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.2369},"relatedVulnerabilities":[{"id":"CVE-2026-78678","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78678","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287","https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-blame"],"description":"GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78678","epss":0.00412,"percentile":0.35469,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78678","cwe":"CWE-88","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-5xxx-qhh7-9287","versionConstraint":"<=3.1.58 (python)"},"fix":{"suggestedVersion":"3.1.59"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-hh9p-6wh2-4mfc","dataSource":"https://github.com/advisories/GHSA-hh9p-6wh2-4mfc","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc","https://github.com/gitpython-developers/GitPython/pull/2204","https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58","https://nvd.nist.gov/vuln/detail/CVE-2026-76217","https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file"],"description":"GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76217","epss":0.00412,"percentile":0.35468,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76217","cwe":"CWE-73","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.58"],"state":"fixed","available":[{"version":"3.1.58","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.2369},"relatedVulnerabilities":[{"id":"CVE-2026-76217","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76217","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc","https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file"],"description":"GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76217","epss":0.00412,"percentile":0.35468,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76217","cwe":"CWE-73","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-hh9p-6wh2-4mfc","versionConstraint":"<=3.1.57 (python)"},"fix":{"suggestedVersion":"3.1.58"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-qccp-gfcp-xxvc","dataSource":"https://github.com/advisories/GHSA-qccp-gfcp-xxvc","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc","https://nvd.nist.gov/vuln/detail/CVE-2026-44431"],"description":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44431","epss":0.00331,"percentile":0.26333,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44431","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.7.0"],"state":"fixed","available":[{"version":"2.7.0","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.23583750000000003},"relatedVulnerabilities":[{"id":"CVE-2026-44431","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc","https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html"],"description":"urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44431","epss":0.00331,"percentile":0.26333,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44431","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"1.26.20"}},"found":{"vulnerabilityID":"GHSA-qccp-gfcp-xxvc","versionConstraint":">=1.23,<2.7.0 (python)"},"fix":{"suggestedVersion":"2.7.0"}}],"artifact":{"id":"pkg:pypi/urllib3@1.26.20?package-id=89915b9d94ed6e06","name":"urllib3","version":"1.26.20","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:1.26.20:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@1.26.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-6cjc-53gc-5rqm","dataSource":"https://github.com/advisories/GHSA-6cjc-53gc-5rqm","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6cjc-53gc-5rqm","https://nvd.nist.gov/vuln/detail/CVE-2026-111065","https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f1237ef2c1574a8c82a739fca5805","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"],"description":"AIOHTTP: Connector pool exhaustion via Max-Age overflow","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111065","epss":0.00395,"percentile":0.3378,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111065","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.4"],"state":"fixed","available":[{"version":"3.14.4","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.23502499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-111065","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111065","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f1237ef2c1574a8c82a739fca5805","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6cjc-53gc-5rqm"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111065","epss":0.00395,"percentile":0.3378,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111065","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-6cjc-53gc-5rqm","versionConstraint":"<=3.14.3 (python)"},"fix":{"suggestedVersion":"3.14.4"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-54p9-h82j-f925","dataSource":"https://github.com/advisories/GHSA-54p9-h82j-f925","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/multidict/security/advisories/GHSA-54p9-h82j-f925","https://nvd.nist.gov/vuln/detail/CVE-2026-104874","https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40","https://github.com/aio-libs/multidict/releases/tag/v6.9.1"],"description":"Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104874","epss":0.00448,"percentile":0.38972,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104874","cwe":"CWE-401","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.9.1"],"state":"fixed","available":[{"version":"6.9.1","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.23071999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-104874","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104874","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40","https://github.com/aio-libs/multidict/releases/tag/v6.9.1","https://github.com/aio-libs/multidict/security/advisories/GHSA-54p9-h82j-f925"],"description":"Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104874","epss":0.00448,"percentile":0.38972,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104874","cwe":"CWE-401","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"multidict","version":"6.7.1"}},"found":{"vulnerabilityID":"GHSA-54p9-h82j-f925","versionConstraint":">=6.7.0,<=6.9.0 (python)"},"fix":{"suggestedVersion":"6.9.1"}}],"artifact":{"id":"pkg:pypi/multidict@6.7.1?package-id=0980d0bd43e7138d","name":"multidict","version":"6.7.1","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-multidict:python-multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python-multidict:python_multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python_multidict:python-multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python_multidict:python_multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:multidict:python-multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:multidict:python_multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python-multidict:multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python_multidict:multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:multidict:multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python:multidict:6.7.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/multidict@6.7.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-f9xw-jh8m-3mwq","dataSource":"https://github.com/advisories/GHSA-f9xw-jh8m-3mwq","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-f9xw-jh8m-3mwq","https://nvd.nist.gov/vuln/detail/CVE-2026-111748","https://github.com/aio-libs/aiohttp/commit/6d4e7b01f9b951aa084a75d7356e907d4ee80411","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"],"description":"AIOHTTP: Absolute-form request targets can spoof Request.scheme","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111748","epss":0.00386,"percentile":0.32736,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111748","cwe":"CWE-807","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.4"],"state":"fixed","available":[{"version":"3.14.4","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.21809},"relatedVulnerabilities":[{"id":"CVE-2026-111748","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111748","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/commit/6d4e7b01f9b951aa084a75d7356e907d4ee80411","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-f9xw-jh8m-3mwq"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111748","epss":0.00386,"percentile":0.32736,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111748","cwe":"CWE-807","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-f9xw-jh8m-3mwq","versionConstraint":"<=3.14.3 (python)"},"fix":{"suggestedVersion":"3.14.4"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-pqxq-w44r-73xw","dataSource":"https://github.com/advisories/GHSA-pqxq-w44r-73xw","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pqxq-w44r-73xw","https://nvd.nist.gov/vuln/detail/CVE-2026-111750","https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"],"description":"AIOHTTP: Pure-Python parser request smuggling","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111750","epss":0.00382,"percentile":0.32196,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111750","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.4"],"state":"fixed","available":[{"version":"3.14.4","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.21582999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-111750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111750","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pqxq-w44r-73xw"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111750","epss":0.00382,"percentile":0.32196,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111750","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-pqxq-w44r-73xw","versionConstraint":"<=3.14.3 (python)"},"fix":{"suggestedVersion":"3.14.4"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-3rp5-jjmw-4wv2","dataSource":"https://github.com/advisories/GHSA-3rp5-jjmw-4wv2","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2","https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.53","https://github.com/gitpython-developers/GitPython/pull/2176","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3981.yaml","https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-names"],"description":"GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69097","epss":0.00268,"percentile":0.18968,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69097","cwe":"CWE-74","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.53"],"state":"fixed","available":[{"version":"3.1.53","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.1943},"relatedVulnerabilities":[{"id":"CVE-2026-69097","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69097","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2","https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-names"],"description":"GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"exploitabilityScore":1.4,"impactScore":5.9},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69097","epss":0.00268,"percentile":0.18968,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69097","cwe":"CWE-74","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-3rp5-jjmw-4wv2","versionConstraint":"<=3.1.52 (python)"},"fix":{"suggestedVersion":"3.1.53"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-3wxw-xv34-2frg","dataSource":"https://github.com/advisories/GHSA-3wxw-xv34-2frg","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg","https://nvd.nist.gov/vuln/detail/CVE-2026-78679","https://github.com/gitpython-developers/GitPython/pull/2208","https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59","https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create"],"description":"GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78679","epss":0.00316,"percentile":0.24567,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78679","cwe":"CWE-73","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.59"],"state":"fixed","available":[{"version":"3.1.59","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.18169999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-78679","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg","https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create"],"description":"GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbitrary files, with contents returned in the annotated tag message.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78679","epss":0.00316,"percentile":0.24567,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78679","cwe":"CWE-73","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-3wxw-xv34-2frg","versionConstraint":"<=3.1.58 (python)"},"fix":{"suggestedVersion":"3.1.59"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-v87r-6q3f-2j67","dataSource":"https://github.com/advisories/GHSA-v87r-6q3f-2j67","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67","https://nvd.nist.gov/vuln/detail/CVE-2026-44244","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49"],"description":"GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44244","epss":0.00237,"percentile":0.14762,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44244","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.49"],"state":"fixed","available":[{"version":"3.1.49","date":"2026-05-07","kind":"first-observed"}]},"advisories":[],"risk":0.181305},"relatedVulnerabilities":[{"id":"CVE-2026-44244","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44244","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67"],"description":"GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \\n becomes \\n\\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44244","epss":0.00237,"percentile":0.14762,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44244","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-v87r-6q3f-2j67","versionConstraint":"<=3.1.48 (python)"},"fix":{"suggestedVersion":"3.1.49"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-hpj7-wq8m-9hgp","dataSource":"https://github.com/advisories/GHSA-hpj7-wq8m-9hgp","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp","https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa"],"description":"aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54276","epss":0.00307,"percentile":0.23497,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54276","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-54276","cwe":"CWE-522","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-54276","cwe":"CWE-601","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.14.1"],"state":"fixed","available":[{"version":"3.14.1","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.17345499999999997},"relatedVulnerabilities":[{"id":"CVE-2026-54276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54276","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability is fixed in 3.14.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54276","epss":0.00307,"percentile":0.23497,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54276","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-54276","cwe":"CWE-522","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-54276","cwe":"CWE-601","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-hpj7-wq8m-9hgp","versionConstraint":"<=3.14.0 (python)"},"fix":{"suggestedVersion":"3.14.1"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-8988-9cw3-xx77","dataSource":"https://github.com/advisories/GHSA-8988-9cw3-xx77","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97687","epss":0.00206,"percentile":0.10662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-97687","cwe":"CWE-440","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.15553},"relatedVulnerabilities":[{"id":"CVE-2026-97687","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"],"description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97687","epss":0.00206,"percentile":0.10662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-97687","cwe":"CWE-440","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"1.26.20"}},"found":{"vulnerabilityID":"GHSA-8988-9cw3-xx77","versionConstraint":">=1.26.0,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@1.26.20?package-id=89915b9d94ed6e06","name":"urllib3","version":"1.26.20","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:1.26.20:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@1.26.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-m6qw-4cw2-hm4m","dataSource":"https://github.com/advisories/GHSA-m6qw-4cw2-hm4m","namespace":"github:language:python","severity":"Low","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m","https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8"],"description":"aiohttp: CRLF injection in multipart headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50269","epss":0.00533,"percentile":0.45054,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50269","cwe":"CWE-93","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-50269","cwe":"CWE-113","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.0"],"state":"fixed","available":[{"version":"3.14.0","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.151905},"relatedVulnerabilities":[{"id":"CVE-2026-50269","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50269","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50269","epss":0.00533,"percentile":0.45054,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50269","cwe":"CWE-93","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-50269","cwe":"CWE-113","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-m6qw-4cw2-hm4m","versionConstraint":"<=3.13.5 (python)"},"fix":{"suggestedVersion":"3.14.0"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-7833-fr7j-v32q","dataSource":"https://github.com/advisories/GHSA-7833-fr7j-v32q","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q","https://nvd.nist.gov/vuln/detail/CVE-2026-78675","https://github.com/gitpython-developers/GitPython/pull/2211","https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3785.yaml","https://www.vulncheck.com/advisories/gitpython-before-local-file-content-disclosure-via-gitmodules"],"description":"GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78675","epss":0.00178,"percentile":0.07353,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78675","cwe":"CWE-73","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.1.59"],"state":"fixed","available":[{"version":"3.1.59","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.1424},"relatedVulnerabilities":[{"id":"CVE-2026-78675","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78675","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q","https://www.vulncheck.com/advisories/gitpython-before-local-file-content-disclosure-via-gitmodules"],"description":"GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78675","epss":0.00178,"percentile":0.07353,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78675","cwe":"CWE-73","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-7833-fr7j-v32q","versionConstraint":"<=3.1.58 (python)"},"fix":{"suggestedVersion":"3.1.59"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-4m7w-qmgq-4wj5","dataSource":"https://github.com/advisories/GHSA-4m7w-qmgq-4wj5","namespace":"github:language:python","severity":"Low","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5"],"description":"aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54275","epss":0.0047,"percentile":0.40708,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54275","cwe":"CWE-297","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.1"],"state":"fixed","available":[{"version":"3.14.1","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.13395},"relatedVulnerabilities":[{"id":"CVE-2026-54275","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54275","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54275","epss":0.0047,"percentile":0.40708,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54275","cwe":"CWE-297","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-4m7w-qmgq-4wj5","versionConstraint":"<=3.14.0 (python)"},"fix":{"suggestedVersion":"3.14.1"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-494j-54xm-rwp3","dataSource":"https://github.com/advisories/GHSA-494j-54xm-rwp3","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3","https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","https://nvd.nist.gov/vuln/detail/CVE-2026-111063"],"description":"AIOHTTP: Secure attribute not enforced for shared cookie","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111063","epss":0.00233,"percentile":0.14215,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111063","cwe":"CWE-311","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111063","cwe":"CWE-1004","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.4"],"state":"fixed","available":[{"version":"3.14.4","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.13164499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-111063","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111063","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111063","epss":0.00233,"percentile":0.14215,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111063","cwe":"CWE-311","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111063","cwe":"CWE-1004","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-494j-54xm-rwp3","versionConstraint":"<=3.14.3 (python)"},"fix":{"suggestedVersion":"3.14.4"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-9x8q-7h8h-wcw9","dataSource":"https://github.com/advisories/GHSA-9x8q-7h8h-wcw9","namespace":"github:language:python","severity":"Low","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9","https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587"],"description":"aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":1.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54280","epss":0.0046,"percentile":0.39933,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54280","cwe":"CWE-404","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.1"],"state":"fixed","available":[{"version":"3.14.1","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.10809999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-54280","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54280","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54280","epss":0.0046,"percentile":0.39933,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54280","cwe":"CWE-404","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-9x8q-7h8h-wcw9","versionConstraint":"<=3.14.0 (python)"},"fix":{"suggestedVersion":"3.14.1"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-2fqr-mr3j-6wp8","dataSource":"https://github.com/advisories/GHSA-2fqr-mr3j-6wp8","namespace":"github:language:python","severity":"Low","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8"],"description":"aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54279","epss":0.00493,"percentile":0.42381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54279","cwe":"CWE-665","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.1"],"state":"fixed","available":[{"version":"3.14.1","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.105995},"relatedVulnerabilities":[{"id":"CVE-2026-54279","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54279","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54279","epss":0.00493,"percentile":0.42381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54279","cwe":"CWE-665","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-2fqr-mr3j-6wp8","versionConstraint":"<=3.14.0 (python)"},"fix":{"suggestedVersion":"3.14.1"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-jg22-mg44-37j8","dataSource":"https://github.com/advisories/GHSA-jg22-mg44-37j8","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8","https://nvd.nist.gov/vuln/detail/CVE-2026-34993","https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00"],"description":"AIOHTTP is Vulnerable to Deserialization of Untrusted Data","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":0.7,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34993","epss":0.00179,"percentile":0.07465,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34993","cwe":"CWE-502","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34993","cwe":"CWE-502","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.14.0"],"state":"fixed","available":[{"version":"3.14.0","date":"2026-06-04","kind":"first-observed"}]},"advisories":[],"risk":0.10203000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-34993","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:34456","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50340","https://access.redhat.com/errata/RHSA-2026:50357","https://access.redhat.com/errata/RHSA-2026:50479","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:59135","https://access.redhat.com/errata/RHSA-2026:59136","https://access.redhat.com/errata/RHSA-2026:59518","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62335","https://access.redhat.com/errata/RHSA-2026:62336","https://access.redhat.com/errata/RHSA-2026:63327","https://access.redhat.com/errata/RHSA-2026:63385","https://access.redhat.com/errata/RHSA-2026:63386","https://access.redhat.com/errata/RHSA-2026:63387","https://access.redhat.com/security/cve/CVE-2026-34993","https://bugzilla.redhat.com/show_bug.cgi?id=2484099","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34993.json"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"exploitabilityScore":1.4,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.7,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":0.7,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34993","epss":0.00179,"percentile":0.07465,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34993","cwe":"CWE-502","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34993","cwe":"CWE-502","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-jg22-mg44-37j8","versionConstraint":"<3.14.0 (python)"},"fix":{"suggestedVersion":"3.14.0"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-gx76-c99x-2c96","dataSource":"https://github.com/advisories/GHSA-gx76-c99x-2c96","namespace":"github:language:python","severity":"Low","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gx76-c99x-2c96","https://nvd.nist.gov/vuln/detail/CVE-2026-111749","https://github.com/aio-libs/aiohttp/commit/6a07c171ef9f3be583e2907dcd1931372efca8d6","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"],"description":"AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111749","epss":0.00384,"percentile":0.32465,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111749","cwe":"CWE-565","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.4"],"state":"fixed","available":[{"version":"3.14.4","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.10176},"relatedVulnerabilities":[{"id":"CVE-2026-111749","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111749","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/aio-libs/aiohttp/commit/6a07c171ef9f3be583e2907dcd1931372efca8d6","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gx76-c99x-2c96"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111749","epss":0.00384,"percentile":0.32465,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111749","cwe":"CWE-565","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-gx76-c99x-2c96","versionConstraint":"<=3.14.3 (python)"},"fix":{"suggestedVersion":"3.14.4"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-gc5v-m9x4-r6x2","dataSource":"https://github.com/advisories/GHSA-gc5v-m9x4-r6x2","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2","https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7","https://github.com/psf/requests/releases/tag/v2.33.0","https://nvd.nist.gov/vuln/detail/CVE-2026-25645"],"description":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25645","epss":0.00189,"percentile":0.0861,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25645","cwe":"CWE-377","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.33.0"],"state":"fixed","available":[{"version":"2.33.0","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.08883},"relatedVulnerabilities":[{"id":"CVE-2026-25645","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7","https://github.com/psf/requests/releases/tag/v2.33.0","https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"],"description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25645","epss":0.00189,"percentile":0.0861,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25645","cwe":"CWE-377","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"requests","version":"2.32.5"}},"found":{"vulnerabilityID":"GHSA-gc5v-m9x4-r6x2","versionConstraint":"<2.33.0 (python)"},"fix":{"suggestedVersion":"2.33.0"}}],"artifact":{"id":"pkg:pypi/requests@2.32.5?package-id=fc0b2e03078ddc3f","name":"requests","version":"2.32.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:requests:2.32.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/requests@2.32.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-89v8-rhwq-hf77","dataSource":"https://github.com/advisories/GHSA-89v8-rhwq-hf77","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77","https://github.com/lmfit/asteval/pull/153","https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4","https://github.com/lmfit/asteval/releases/tag/1.0.9"],"description":"asteval has a Sandbox Escape via BaseException Subclasses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"exploitabilityScore":1.4,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-55244","epss":0.00177,"percentile":0.07295,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-55244","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.0.9"],"state":"fixed","available":[{"version":"1.0.9","date":"2026-08-21","kind":"first-observed"}]},"advisories":[],"risk":0.08850000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-55244","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55244","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/lmfit/asteval/commit/9c625b3674f8d05f206708bb85afca17a87694a4","https://github.com/lmfit/asteval/commit/c49c99a67acb63eb7410231932250bd820380e45","https://github.com/lmfit/asteval/pull/153","https://github.com/lmfit/asteval/releases/tag/1.0.9","https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77"],"description":"ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval(), while run() and eval() in asteval/asteval.py catch Exception rather than these non-Exception BaseException subclasses. When an attacker-controlled expression raises one of these classes, on_raise() passes the class to raise_exception(), and the resulting exception bypasses the interpreter's safety handlers and propagates into the calling application. A consuming service that evaluates untrusted expressions can therefore be terminated or have signal and cleanup handling disrupted, causing denial of service. The separately documented read-only open() capability is not part of this vulnerability. This issue is fixed in version 1.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"exploitabilityScore":1.4,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-55244","epss":0.00177,"percentile":0.07295,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-55244","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"asteval","version":"1.0.6"}},"found":{"vulnerabilityID":"GHSA-89v8-rhwq-hf77","versionConstraint":"<1.0.9 (python)"},"fix":{"suggestedVersion":"1.0.9"}}],"artifact":{"id":"pkg:pypi/asteval@1.0.6?package-id=79211035900ed3ce","name":"asteval","version":"1.0.6","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-asteval:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python-asteval:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python_asteval:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python_asteval:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:asteval:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:asteval:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python-asteval:asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python_asteval:asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:asteval:asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python:asteval:1.0.6:*:*:*:*:*:*:*"],"purl":"pkg:pypi/asteval@1.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-89v8-rhwq-hf77","dataSource":"https://github.com/advisories/GHSA-89v8-rhwq-hf77","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77","https://github.com/lmfit/asteval/pull/153","https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4","https://github.com/lmfit/asteval/releases/tag/1.0.9"],"description":"asteval has a Sandbox Escape via BaseException Subclasses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"exploitabilityScore":1.4,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-55244","epss":0.00177,"percentile":0.07295,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-55244","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.0.9"],"state":"fixed","available":[{"version":"1.0.9","date":"2026-08-21","kind":"first-observed"}]},"advisories":[],"risk":0.08850000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-55244","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55244","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/lmfit/asteval/commit/9c625b3674f8d05f206708bb85afca17a87694a4","https://github.com/lmfit/asteval/commit/c49c99a67acb63eb7410231932250bd820380e45","https://github.com/lmfit/asteval/pull/153","https://github.com/lmfit/asteval/releases/tag/1.0.9","https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77"],"description":"ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval(), while run() and eval() in asteval/asteval.py catch Exception rather than these non-Exception BaseException subclasses. When an attacker-controlled expression raises one of these classes, on_raise() passes the class to raise_exception(), and the resulting exception bypasses the interpreter's safety handlers and propagates into the calling application. A consuming service that evaluates untrusted expressions can therefore be terminated or have signal and cleanup handling disrupted, causing denial of service. The separately documented read-only open() capability is not part of this vulnerability. This issue is fixed in version 1.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"exploitabilityScore":1.4,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-55244","epss":0.00177,"percentile":0.07295,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-55244","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"asteval","version":"1.0.6"}},"found":{"vulnerabilityID":"GHSA-89v8-rhwq-hf77","versionConstraint":"<1.0.9 (python)"},"fix":{"suggestedVersion":"1.0.9"}}],"artifact":{"id":"pkg:pypi/asteval@1.0.6?package-id=22d4bde6b17f2962","name":"asteval","version":"1.0.6","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-asteval:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python-asteval:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python_asteval:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python_asteval:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:asteval:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:asteval:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python-asteval:asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python_asteval:asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:asteval:asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python:asteval:1.0.6:*:*:*:*:*:*:*"],"purl":"pkg:pypi/asteval@1.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-hg6j-4rv6-33pg","dataSource":"https://github.com/advisories/GHSA-hg6j-4rv6-33pg","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pg","https://nvd.nist.gov/vuln/detail/CVE-2026-47265","https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478"],"description":"AIOHTTP is vulnerable to cross-origin redirect with per-request cookies","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47265","epss":0.0015,"percentile":0.04156,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47265","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.0"],"state":"fixed","available":[{"version":"3.14.0","date":"2026-06-04","kind":"first-observed"}]},"advisories":[],"risk":0.087},"relatedVulnerabilities":[{"id":"CVE-2026-47265","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47265","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pg"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47265","epss":0.0015,"percentile":0.04156,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47265","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-hg6j-4rv6-33pg","versionConstraint":"<3.14.0 (python)"},"fix":{"suggestedVersion":"3.14.0"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-6q48-6c7w-9gw2","dataSource":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2","namespace":"github:language:python","severity":"Critical","urls":["https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2","https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576","https://emudhra.we-have-a-problem.com"],"description":"certifi bundles emSign root CAs with compromised intermediate CA keys","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"vendorMetadata":{}}],"fix":{"versions":["2026.10.18"],"state":"fixed","available":[{"version":"2026.10.18","date":"2026-10-26","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"certifi","version":"2026.7.22"}},"found":{"vulnerabilityID":"GHSA-6q48-6c7w-9gw2","versionConstraint":">=2019.03.09,<2026.10.18 (python)"},"fix":{"suggestedVersion":"2026.10.18"}}],"artifact":{"id":"pkg:pypi/certifi@2026.7.22?package-id=025d2b4ac5284d2b","name":"certifi","version":"2026.7.22","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:certifi:certifi:2026.7.22:*:*:*:*:python:*:*"],"purl":"pkg:pypi/certifi@2026.7.22","upstreams":[]}},{"vulnerability":{"id":"GHSA-5xjx-3w67-w9x9","dataSource":"https://github.com/advisories/GHSA-5xjx-3w67-w9x9","namespace":"github:language:github-action","severity":"Critical","urls":["https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9"],"description":"pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"fix":{"versions":["1.14.3"],"state":"fixed","available":[{"version":"1.14.3","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"pypa/gh-action-pypi-publish","version":"v1"}},"found":{"vulnerabilityID":"GHSA-5xjx-3w67-w9x9","versionConstraint":"<=1.14.2 (unknown)"},"fix":{"suggestedVersion":"1.14.3"}}],"artifact":{"id":"pkg:github/pypa/gh-action-pypi-publish@v1?package-id=7f1bfc7f6d2f55f1","name":"pypa/gh-action-pypi-publish","version":"v1","type":"github-action","locations":[{"path":"/.github/workflows/build.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*"],"purl":"pkg:github/pypa/gh-action-pypi-publish@v1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2g87-pp6c-29x5","dataSource":"https://github.com/advisories/GHSA-2g87-pp6c-29x5","namespace":"github:language:python","severity":"High","urls":["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2g87-pp6c-29x5","https://github.com/aio-libs/aiohttp/commit/09bcaa73ff084a0c539bbf16a0a78743acb7141f","https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6","https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df","https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7","https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53","https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa","https://github.com/aio-libs/aiohttp/commit/6a4f6682817839313b04b8e5cea2b39c1a88ab4f","https://github.com/aio-libs/aiohttp/commit/8cfbe9abe5e11b84006a10f9bdf82bf607671dab","https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd","https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43","https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"],"description":"aiohttp: Multiple instances of excessive or unbounded memory/CPU use","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"fix":{"versions":["3.14.4"],"state":"fixed","available":[{"version":"3.14.4","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"aiohttp","version":"3.13.5"}},"found":{"vulnerabilityID":"GHSA-2g87-pp6c-29x5","versionConstraint":"<=3.14.3 (python)"},"fix":{"suggestedVersion":"3.14.4"}}],"artifact":{"id":"pkg:pypi/aiohttp@3.13.5?package-id=38b6fdafaee1daed","name":"aiohttp","version":"3.13.5","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python-aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python_aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:aiohttp:aiohttp:3.13.5:*:*:*:*:*:*:*","cpe:2.3:a:python:aiohttp:3.13.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/aiohttp@3.13.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-23mf-xhv8-69c2","dataSource":"https://github.com/advisories/GHSA-23mf-xhv8-69c2","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2","https://github.com/gitpython-developers/GitPython/pull/2233","https://github.com/gitpython-developers/GitPython/commit/8da65080849a56a2fc9f3e7817bbf0524e8397d5","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"],"description":"GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"fix":{"versions":["3.2.0"],"state":"fixed","available":[{"version":"3.2.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-23mf-xhv8-69c2","versionConstraint":"<=3.1.62 (python)"},"fix":{"suggestedVersion":"3.2.0"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-3f7w-8rr8-f37f","dataSource":"https://github.com/advisories/GHSA-3f7w-8rr8-f37f","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f","https://github.com/gitpython-developers/GitPython/pull/2193","https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57"],"description":"GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"fix":{"versions":["3.1.57"],"state":"fixed","available":[{"version":"3.1.57","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-3f7w-8rr8-f37f","versionConstraint":"<=3.1.56 (python)"},"fix":{"suggestedVersion":"3.1.57"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-6p8h-3wgx-97gf","dataSource":"https://github.com/advisories/GHSA-6p8h-3wgx-97gf","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf","https://github.com/gitpython-developers/GitPython/pull/2180","https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"],"description":"GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["3.1.54"],"state":"fixed","available":[{"version":"3.1.54","date":"2026-07-25","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-6p8h-3wgx-97gf","versionConstraint":"<=3.1.53 (python)"},"fix":{"suggestedVersion":"3.1.54"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-94p4-4cq8-9g67","dataSource":"https://github.com/advisories/GHSA-94p4-4cq8-9g67","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67","https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.55","https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3951.yaml","https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add"],"description":"GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.1.55"],"state":"fixed","available":[{"version":"3.1.55","date":"2026-07-25","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-94p4-4cq8-9g67","versionConstraint":"<3.1.55 (python)"},"fix":{"suggestedVersion":"3.1.55"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-f9j4-qggq-h239","dataSource":"https://github.com/advisories/GHSA-f9j4-qggq-h239","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239","https://github.com/gitpython-developers/GitPython/pull/2247","https://github.com/gitpython-developers/GitPython/commit/790bb3164948625ffb043d2a162425d55923fe9a","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"],"description":"GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["3.2.0"],"state":"fixed","available":[{"version":"3.2.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-f9j4-qggq-h239","versionConstraint":">=3.1.30,<3.2.0 (python)"},"fix":{"suggestedVersion":"3.2.0"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-fjr4-x663-mwxc","dataSource":"https://github.com/advisories/GHSA-fjr4-x663-mwxc","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc","https://github.com/gitpython-developers/GitPython/pull/2180","https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"],"description":"GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"fix":{"versions":["3.1.54"],"state":"fixed","available":[{"version":"3.1.54","date":"2026-07-25","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-fjr4-x663-mwxc","versionConstraint":"<=3.1.53 (python)"},"fix":{"suggestedVersion":"3.1.54"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-jm78-9fvv-mhgr","dataSource":"https://github.com/advisories/GHSA-jm78-9fvv-mhgr","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr","https://github.com/gitpython-developers/GitPython/pull/2204","https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"],"description":"GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["3.1.58"],"state":"fixed","available":[{"version":"3.1.58","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-jm78-9fvv-mhgr","versionConstraint":"<=3.1.57 (python)"},"fix":{"suggestedVersion":"3.1.58"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-m64x-33q8-m5h7","dataSource":"https://github.com/advisories/GHSA-m64x-33q8-m5h7","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-m64x-33q8-m5h7","https://github.com/gitpython-developers/GitPython/pull/2253","https://github.com/gitpython-developers/GitPython/commit/8290c98d35465a38090cdcc1b17be69967092a15","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"],"description":"GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"fix":{"versions":["3.2.0"],"state":"fixed","available":[{"version":"3.2.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-m64x-33q8-m5h7","versionConstraint":"<=3.1.62 (python)"},"fix":{"suggestedVersion":"3.2.0"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-mv93-w799-cj2w","dataSource":"https://github.com/advisories/GHSA-mv93-w799-cj2w","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w","https://github.com/advisories/GHSA-rpm5-65cw-6hj4"],"description":"GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["3.1.50"],"state":"fixed","available":[{"version":"3.1.50","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-mv93-w799-cj2w","versionConstraint":"<=3.1.49 (python)"},"fix":{"suggestedVersion":"3.1.50"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-r9mr-m37c-5fr3","dataSource":"https://github.com/advisories/GHSA-r9mr-m37c-5fr3","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3","https://github.com/gitpython-developers/GitPython/pull/2180","https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"],"description":"GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["3.1.54"],"state":"fixed","available":[{"version":"3.1.54","date":"2026-07-25","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-r9mr-m37c-5fr3","versionConstraint":"<=3.1.53 (python)"},"fix":{"suggestedVersion":"3.1.54"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-w8jc-g24h-crhw","dataSource":"https://github.com/advisories/GHSA-w8jc-g24h-crhw","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-w8jc-g24h-crhw","https://github.com/gitpython-developers/GitPython/pull/2251","https://github.com/gitpython-developers/GitPython/commit/9ad28cc4c7176d22cd6181d69805058a719dd03b","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"],"description":"GitPython command wrappers omit unsafe protocol and option checks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["3.2.0"],"state":"fixed","available":[{"version":"3.2.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-w8jc-g24h-crhw","versionConstraint":"<=3.1.62 (python)"},"fix":{"suggestedVersion":"3.2.0"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-23mf-xhv8-69c2","dataSource":"https://github.com/advisories/GHSA-23mf-xhv8-69c2","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2","https://github.com/gitpython-developers/GitPython/pull/2233","https://github.com/gitpython-developers/GitPython/commit/8da65080849a56a2fc9f3e7817bbf0524e8397d5","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"],"description":"GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"fix":{"versions":["3.2.0"],"state":"fixed","available":[{"version":"3.2.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.59"}},"found":{"vulnerabilityID":"GHSA-23mf-xhv8-69c2","versionConstraint":"<=3.1.62 (python)"},"fix":{"suggestedVersion":"3.2.0"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.59?package-id=c4d193d5eddc05f4","name":"gitpython","version":"3.1.59","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.59:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.59","upstreams":[]}},{"vulnerability":{"id":"GHSA-f9j4-qggq-h239","dataSource":"https://github.com/advisories/GHSA-f9j4-qggq-h239","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239","https://github.com/gitpython-developers/GitPython/pull/2247","https://github.com/gitpython-developers/GitPython/commit/790bb3164948625ffb043d2a162425d55923fe9a","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"],"description":"GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["3.2.0"],"state":"fixed","available":[{"version":"3.2.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.59"}},"found":{"vulnerabilityID":"GHSA-f9j4-qggq-h239","versionConstraint":">=3.1.30,<3.2.0 (python)"},"fix":{"suggestedVersion":"3.2.0"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.59?package-id=c4d193d5eddc05f4","name":"gitpython","version":"3.1.59","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.59:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.59","upstreams":[]}},{"vulnerability":{"id":"GHSA-m64x-33q8-m5h7","dataSource":"https://github.com/advisories/GHSA-m64x-33q8-m5h7","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-m64x-33q8-m5h7","https://github.com/gitpython-developers/GitPython/pull/2253","https://github.com/gitpython-developers/GitPython/commit/8290c98d35465a38090cdcc1b17be69967092a15","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"],"description":"GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"fix":{"versions":["3.2.0"],"state":"fixed","available":[{"version":"3.2.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.59"}},"found":{"vulnerabilityID":"GHSA-m64x-33q8-m5h7","versionConstraint":"<=3.1.62 (python)"},"fix":{"suggestedVersion":"3.2.0"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.59?package-id=c4d193d5eddc05f4","name":"gitpython","version":"3.1.59","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.59:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.59","upstreams":[]}},{"vulnerability":{"id":"GHSA-w8jc-g24h-crhw","dataSource":"https://github.com/advisories/GHSA-w8jc-g24h-crhw","namespace":"github:language:python","severity":"High","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-w8jc-g24h-crhw","https://github.com/gitpython-developers/GitPython/pull/2251","https://github.com/gitpython-developers/GitPython/commit/9ad28cc4c7176d22cd6181d69805058a719dd03b","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"],"description":"GitPython command wrappers omit unsafe protocol and option checks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["3.2.0"],"state":"fixed","available":[{"version":"3.2.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.59"}},"found":{"vulnerabilityID":"GHSA-w8jc-g24h-crhw","versionConstraint":"<=3.1.62 (python)"},"fix":{"suggestedVersion":"3.2.0"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.59?package-id=c4d193d5eddc05f4","name":"gitpython","version":"3.1.59","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.59:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.59","upstreams":[]}},{"vulnerability":{"id":"GHSA-9w56-46f6-3qhx","dataSource":"https://github.com/advisories/GHSA-9w56-46f6-3qhx","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx","https://github.com/lmfit/asteval/pull/153","https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4","https://github.com/lmfit/asteval/releases/tag/1.0.9"],"description":"asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["1.0.9"],"state":"fixed","available":[{"version":"1.0.9","date":"2026-08-21","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"asteval","version":"1.0.6"}},"found":{"vulnerabilityID":"GHSA-9w56-46f6-3qhx","versionConstraint":"<1.0.9 (python)"},"fix":{"suggestedVersion":"1.0.9"}}],"artifact":{"id":"pkg:pypi/asteval@1.0.6?package-id=22d4bde6b17f2962","name":"asteval","version":"1.0.6","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-asteval:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python-asteval:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python_asteval:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python_asteval:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:asteval:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:asteval:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python-asteval:asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python_asteval:asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:asteval:asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python:asteval:1.0.6:*:*:*:*:*:*:*"],"purl":"pkg:pypi/asteval@1.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-9w56-46f6-3qhx","dataSource":"https://github.com/advisories/GHSA-9w56-46f6-3qhx","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx","https://github.com/lmfit/asteval/pull/153","https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4","https://github.com/lmfit/asteval/releases/tag/1.0.9"],"description":"asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["1.0.9"],"state":"fixed","available":[{"version":"1.0.9","date":"2026-08-21","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"asteval","version":"1.0.6"}},"found":{"vulnerabilityID":"GHSA-9w56-46f6-3qhx","versionConstraint":"<1.0.9 (python)"},"fix":{"suggestedVersion":"1.0.9"}}],"artifact":{"id":"pkg:pypi/asteval@1.0.6?package-id=79211035900ed3ce","name":"asteval","version":"1.0.6","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-asteval:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python-asteval:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python_asteval:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python_asteval:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:asteval:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:asteval:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python-asteval:asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python_asteval:asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python:python-asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python:python_asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:asteval:asteval:1.0.6:*:*:*:*:*:*:*","cpe:2.3:a:python:asteval:1.0.6:*:*:*:*:*:*:*"],"purl":"pkg:pypi/asteval@1.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-539m-9xh6-q6rr","dataSource":"https://github.com/advisories/GHSA-539m-9xh6-q6rr","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr","https://github.com/gitpython-developers/GitPython/pull/2193","https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57"],"description":"GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.1.57"],"state":"fixed","available":[{"version":"3.1.57","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-539m-9xh6-q6rr","versionConstraint":"<=3.1.56 (python)"},"fix":{"suggestedVersion":"3.1.57"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-59cr-6r3x-644w","dataSource":"https://github.com/advisories/GHSA-59cr-6r3x-644w","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-59cr-6r3x-644w","https://github.com/gitpython-developers/GitPython/pull/2225","https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.62"],"description":"GitPython submodule update path traversal can write outside the repository","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.1},"vendorMetadata":{}}],"fix":{"versions":["3.1.62"],"state":"fixed","available":[{"version":"3.1.62","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-59cr-6r3x-644w","versionConstraint":"<=3.1.61 (python)"},"fix":{"suggestedVersion":"3.1.62"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-fx3j-rwgx-fr94","dataSource":"https://github.com/advisories/GHSA-fx3j-rwgx-fr94","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fx3j-rwgx-fr94","https://github.com/gitpython-developers/GitPython/pull/2255","https://github.com/gitpython-developers/GitPython/commit/9349ff58ee00c9fb14d515c8e693f33b2144b238","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"],"description":"GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.2.0"],"state":"fixed","available":[{"version":"3.2.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-fx3j-rwgx-fr94","versionConstraint":"<=3.1.62 (python)"},"fix":{"suggestedVersion":"3.2.0"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-gq48-pqfc-9p58","dataSource":"https://github.com/advisories/GHSA-gq48-pqfc-9p58","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-gq48-pqfc-9p58","https://github.com/gitpython-developers/GitPython/pull/2232","https://github.com/gitpython-developers/GitPython/commit/24b6f95d4b90ab1483fb601c736ac6e7c059cd61","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"],"description":"GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree","cvss":[],"fix":{"versions":["3.2.0"],"state":"fixed","available":[{"version":"3.2.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-gq48-pqfc-9p58","versionConstraint":"<3.2.0 (python)"},"fix":{"suggestedVersion":"3.2.0"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-p538-c434-8v24","dataSource":"https://github.com/advisories/GHSA-p538-c434-8v24","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-p538-c434-8v24","https://github.com/gitpython-developers/GitPython/pull/2184","https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.56"],"description":"GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"fix":{"versions":["3.1.56"],"state":"fixed","available":[{"version":"3.1.56","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.41"}},"found":{"vulnerabilityID":"GHSA-p538-c434-8v24","versionConstraint":"<=3.1.55 (python)"},"fix":{"suggestedVersion":"3.1.56"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.41?package-id=4691c245574374eb","name":"gitpython","version":"3.1.41","type":"python","locations":[{"path":"/setup.py","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.41:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.41:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.41","upstreams":[]}},{"vulnerability":{"id":"GHSA-59cr-6r3x-644w","dataSource":"https://github.com/advisories/GHSA-59cr-6r3x-644w","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-59cr-6r3x-644w","https://github.com/gitpython-developers/GitPython/pull/2225","https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.62"],"description":"GitPython submodule update path traversal can write outside the repository","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.1},"vendorMetadata":{}}],"fix":{"versions":["3.1.62"],"state":"fixed","available":[{"version":"3.1.62","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.59"}},"found":{"vulnerabilityID":"GHSA-59cr-6r3x-644w","versionConstraint":"<=3.1.61 (python)"},"fix":{"suggestedVersion":"3.1.62"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.59?package-id=c4d193d5eddc05f4","name":"gitpython","version":"3.1.59","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.59:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.59","upstreams":[]}},{"vulnerability":{"id":"GHSA-fx3j-rwgx-fr94","dataSource":"https://github.com/advisories/GHSA-fx3j-rwgx-fr94","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fx3j-rwgx-fr94","https://github.com/gitpython-developers/GitPython/pull/2255","https://github.com/gitpython-developers/GitPython/commit/9349ff58ee00c9fb14d515c8e693f33b2144b238","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"],"description":"GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.2.0"],"state":"fixed","available":[{"version":"3.2.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.59"}},"found":{"vulnerabilityID":"GHSA-fx3j-rwgx-fr94","versionConstraint":"<=3.1.62 (python)"},"fix":{"suggestedVersion":"3.2.0"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.59?package-id=c4d193d5eddc05f4","name":"gitpython","version":"3.1.59","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.59:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.59","upstreams":[]}},{"vulnerability":{"id":"GHSA-gq48-pqfc-9p58","dataSource":"https://github.com/advisories/GHSA-gq48-pqfc-9p58","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-gq48-pqfc-9p58","https://github.com/gitpython-developers/GitPython/pull/2232","https://github.com/gitpython-developers/GitPython/commit/24b6f95d4b90ab1483fb601c736ac6e7c059cd61","https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"],"description":"GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree","cvss":[],"fix":{"versions":["3.2.0"],"state":"fixed","available":[{"version":"3.2.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.59"}},"found":{"vulnerabilityID":"GHSA-gq48-pqfc-9p58","versionConstraint":"<3.2.0 (python)"},"fix":{"suggestedVersion":"3.2.0"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.59?package-id=c4d193d5eddc05f4","name":"gitpython","version":"3.1.59","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.59:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.59","upstreams":[]}},{"vulnerability":{"id":"GHSA-whh4-5q6c-9v3x","dataSource":"https://github.com/advisories/GHSA-whh4-5q6c-9v3x","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-whh4-5q6c-9v3x","https://github.com/gitpython-developers/GitPython/pull/2217","https://github.com/gitpython-developers/GitPython/commit/09f2cf383a992d1af697364569e9f384748c1bd8","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3983.yaml","https://www.vulncheck.com/advisories/gitpython-3.1.59-local-file-content-oracle-via-no-index"],"description":"GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.1.60"],"state":"fixed","available":[{"version":"3.1.60","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"gitpython","version":"3.1.59"}},"found":{"vulnerabilityID":"GHSA-whh4-5q6c-9v3x","versionConstraint":">=3.1.59,<3.1.60 (python)"},"fix":{"suggestedVersion":"3.1.60"}}],"artifact":{"id":"pkg:pypi/gitpython@3.1.59?package-id=c4d193d5eddc05f4","name":"gitpython","version":"3.1.59","type":"python","locations":[{"path":"/Pipfile.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python-gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python_gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python-gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:python_gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:gitpython:gitpython:3.1.59:*:*:*:*:*:*:*","cpe:2.3:a:python:gitpython:3.1.59:*:*:*:*:*:*:*"],"purl":"pkg:pypi/gitpython@3.1.59","upstreams":[]}},{"vulnerability":{"id":"GHSA-vxmw-7h4f-hqxh","dataSource":"https://github.com/advisories/GHSA-vxmw-7h4f-hqxh","namespace":"github:language:github-action","severity":"Low","urls":["https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-vxmw-7h4f-hqxh","https://github.com/pypa/gh-action-pypi-publish/commit/77db1b7cf7dcea2e403bb4350516284282740dd6"],"description":"PyPI publish GitHub Action vulnerable to injectable expression expansions in action steps","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","metrics":{"baseScore":0,"exploitabilityScore":3.9,"impactScore":0},"vendorMetadata":{}}],"fix":{"versions":["1.13.0"],"state":"fixed","available":[{"version":"1.13.0","date":"2025-09-06","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"pypa/gh-action-pypi-publish","version":"v1"}},"found":{"vulnerabilityID":"GHSA-vxmw-7h4f-hqxh","versionConstraint":"<1.13.0 (unknown)"},"fix":{"suggestedVersion":"1.13.0"}}],"artifact":{"id":"pkg:github/pypa/gh-action-pypi-publish@v1?package-id=7f1bfc7f6d2f55f1","name":"pypa/gh-action-pypi-publish","version":"v1","type":"github-action","locations":[{"path":"/.github/workflows/build.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh-action-pypi-publish:v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh_action_pypi_publish:v1:*:*:*:*:*:*:*"],"purl":"pkg:github/pypa/gh-action-pypi-publish@v1","upstreams":[]}}],"source":{"type":"file","target":"bridgecrewio/checkov"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:07:06.927102319Z"}}