{"action":"Upgrade gitpython to 3.1.47 or later.","affected":[{"fixed":"3.1.47","introduced":"3.1.30"}],"component":"gitpython","cve_ids":["CVE-2026-42215"],"ecosystem":"PyPI","epss":0.00749,"exploited":false,"fixed_versions":["3.1.47"],"ghsa_id":"GHSA-rpm5-65cw-6hj4","id":"tcs_01M5KGXT9HPA7VGQJPM31NFABD","modified_at":"2026-07-13T07:15:30.240215909Z","published_at":"2026-05-07T19:16:01.640Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2160","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-2160","url":"https://osv.dev/vulnerability/PYSEC-2026-2160"}],"summary":"GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by d"}