All issues

Search results

🟠 [High] GitPython: Unguarded Git Read-Tree Option Forwarding in IndexFile.from_tree/reset/merge_tree Enables Arbitrary File Overwrite

high

security

Status: Open.

#46 In Latch/connectedhomeip;

· it-integrations opened on Aug 18, 2026

🟠 [High] GitPython: Unguarded Git Option Forwarding in Repo.init Enables Arbitrary Command Execution via --Template Clone Hooks

high

security

Status: Open.

#47 In Latch/connectedhomeip;

· it-integrations opened on Aug 18, 2026

🟠 [High] GitPython: Arbitrary File Overwrite via Git Diff --Output Argument Injection in Diffable.diff (Key- And Value-Controlled)

high

security

Status: Open.

#38 In Latch/connectedhomeip;

· it-integrations opened on Aug 6, 2026

🟠 [High] GitPython: Git-Config Section-Name Injection Enables Arbitrary Config Directives (core.sshCommand RCE)

high

security

Status: Open.

#40 In Latch/connectedhomeip;

· it-integrations opened on Aug 6, 2026

🟠 [High] GitPython: Incomplete Unsafe_git_clone_options Denylist Omits --Template Enabling Arbitrary Command Execution via Clone Hooks

high

security

Status: Open.

#41 In Latch/connectedhomeip;

· it-integrations opened on Aug 6, 2026

🟠 [High] GitPython: Unsafe Git Option Guard Bypass via Single-Character Kwarg Value Token Smuggling Enables Arbitrary Command Execution

high

security

Status: Open.

#35 In Latch/connectedhomeip;

· it-integrations opened on Aug 6, 2026

🟠 [High] Python-Cryptography: Duplicate Self-Signed Intermediates Can Cause Exponential Path-Building

high

security

Status: Open.

#34 In Latch/connectedhomeip;

· it-integrations opened on Aug 6, 2026

🟠 [High] GitPython: Unguarded Git Option Forwarding in IndexFile.checkout() and TagReference.create() Enables Arbitrary File Overwrite and Arbitrary File Read

high

security

Status: Open.

#36 In Latch/connectedhomeip;

· it-integrations opened on Aug 6, 2026

🟠 [High] GitPython: Command Injection via Unguarded Git Options in Repo.archive(), git.ls_remote(), and Arbitrary File Overwrite via Repo.iter_commits() / Repo.blame()

high

security

Status: Open.

#42 In Latch/connectedhomeip;

· it-integrations opened on Aug 6, 2026

🟠 [High] GitPython: Environment-Variable Exfiltration via os.path.expandvars() on Repo.clone_from() URL

high

security

Status: Open.

#39 In Latch/connectedhomeip;

· it-integrations opened on Aug 6, 2026

🟠 [High] GitPython: Command Injection via Git Long-Option Prefix Abbreviation Bypass of CVE-2026-42215 Blocklist

high

security

Status: Open.

#43 In Latch/connectedhomeip;

· it-integrations opened on Aug 6, 2026

🟠 [High] GitPython: Environment-Variable Exfiltration via Repo.create_remote() / Remote.add() URL (Incomplete Fix of GHSA-rwj8-pgh3-r573)

high

security

Status: Open.

#37 In Latch/connectedhomeip;

· it-integrations opened on Aug 6, 2026