There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in
    Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack
    (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check
    for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate
    an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these
    methods. (CVE-2026-67323)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71113 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: GitPython: Remote Code Execution via Git directory impersonation (CVE-2026-87817)
    * automation-controller: Job template enumeration via unauthenticated Bitbucket webhook oracle     (CVE-2026-84717)
    * automation-controller: Command argument injection via SystemJob extra_vars (CVE-2026-84724)
    * automation-controller: Masked credential data disclosure via workflow job node artifact search     (CVE-2026-84720)
    * automation-controller: Instance-group privilege escalation via workflow job template copy     (CVE-2026-84719)
    * automation-controller: Audit log falsification via unrestricted X-Forwarded-For trust (CVE-2026-84718)
    * automation-controller: Mesh certificate issuance for arbitrary hostnames via install bundle     (CVE-2026-84716)
    * automation-controller: Template injection via sanitize_jinja regex bypass (CVE-2026-84714)
    * automation-controller: Automation mesh topology disclosure via unauthenticated ping endpoint     (CVE-2026-84712)
    * automation-controller: Arbitrary file read via Project scm_branch git argument injection     (CVE-2026-84711)
    * automation-controller: Denial of service via credential type injector Jinja rendering (CVE-2026-84709)
    * automation-controller: Control-plane secret exposure via container group pod spec override     (CVE-2026-84708)
    * automation-controller: Unauthorized job output disclosure via host filter query traversal     (CVE-2026-84707)
    * automation-controller: Code execution via credential type environment-injector blocklist bypass     (CVE-2026-84706)
    * automation-controller: Cross-tenant credential exposure via execution environment binding     (CVE-2026-84703)
    * automation-controller: Cross-tenant execution privilege bypass via workflow job template node patch     (CVE-2026-84692)
    * automation-controller: Secret key and database credential disclosure via format-string injection     (CVE-2026-84691)
    * automation-controller: Cross-tenant job hijack via Bulk Job Launch node reference (CVE-2026-84689)
    * automation-controller: Credential token disclosure via notification template type-switch replay     (CVE-2026-84686)
    * automation-controller: Privilege escalation via constructed inventory attachment (CVE-2026-84684)
    * automation-controller: Stored cross-site scripting via ANSI hyperlink sequence in job output     (CVE-2026-84683)
    * automation-controller: Credential-use privilege escalation via organization Galaxy credential attachment     (CVE-2026-84680)
    * automation-controller: Arbitrary environment variable injection via AWX_TASK_ENV setting     (CVE-2026-84679)
    * automation-controller: Server-side request forgery via Thycotic Secret Server credential test     (CVE-2026-84644)
    * automation-controller: Cross-organization credential exposure via Project signature-validation binding     (CVE-2026-84643)
    * automation-controller: Instance-group privilege escalation via Schedule and workflow node attachment     (CVE-2026-84638)
    * automation-controller: Remote code execution via Project scm_url git argument injection (CVE-2026-84502)
    * automation-controller: Survey password disclosure via validation error message (CVE-2026-84499)
    * automation-controller: Unauthenticated scheduler-trigger endpoint exposure (regression) (CVE-2026-84486)
    * automation-controller: Privilege escalation via provisioning-callback host-match bypass (CVE-2026-84474)
    * automation-controller: Instance-group privilege escalation via Bulk Job Launch permission check     (CVE-2026-84470)
    * automation-controller: GitPython: Arbitrary file read via TagReference.create() (CVE-2026-78679)
    * automation-controller: awx: Privilege escalation to OpenShift namespace via pod_spec_override injection     in container groups (CVE-2026-75884)
    * automation-controller: Command-line argument injection via ad hoc command limit field (CVE-2026-71465)
    * automation-controller: Git argument-injection guard bypass via Schedule scm_branch prompt     (CVE-2026-71464)
    * automation-controller: Stack trace disclosure via notification-template Jinja whitelist bypass     (CVE-2026-71463)
    * automation-controller: Filesystem path-existence oracle via CUSTOM_VENV_PATHS validation     (CVE-2026-71462)
    * automation-controller: Cross-tenant job event data exposure via missing RBAC check (CVE-2026-71459)
    * automation-controller: Cross-tenant resource enumeration via Named-URL 404 response oracle     (CVE-2026-71458)
    * automation-controller: Unrestricted subscription and license information disclosure (CVE-2026-71460)
    * automation-controller: GitPython: Command Injection via Git option prefix abbreviation (CVE-2026-67325)
    * automation-controller: GitPython: Arbitrary code execution via command injection due to unguarded Git     options (CVE-2026-67323)
    * automation-controller: GitPython: Environment variable exfiltration via attacker-controlled clone URL     (CVE-2026-67322)
    * automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF     (CVE-2026-12564)
    * automation-gateway-proxy: Golang MIME: Denial of Service via maliciously-crafted MIME header     (CVE-2026-42504)
    * automation-gateway-proxy: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
    * automation-gateway-proxy: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)
    * automation-gateway-proxy: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)
    * automation-gateway-proxy: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
    * automation-platform-ui: js-yaml: Denial of Service vulnerability in YAML parsing (CVE-2026-84375)
    * automation-platform-ui: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization (CVE-2026-75838)
    * automation-platform-ui: nanoid: Denial of Service via negative size input in non-secure module functions     (CVE-2026-67214)
    * automation-platform-ui: nanoid: Predictable ID generation due to integer overflow (CVE-2026-73086)
    * automation-platform-ui: PostCSS: Information disclosure via crafted sourceMappingURL (CVE-2026-69153)
    * automation-platform-ui: js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869)
    * python-sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing (CVE-2026-54284)
    * python-sqlparse: Denial of Service via inefficient SQL parsing (CVE-2026-59893)
    * python-sqlparse: Denial of Service via quadratic CPU consumption in comment grouping (CVE-2026-71491)
    * python3.12-gitpython: Remote Code Execution via Git directory impersonation (CVE-2026-87817)
    * python3.12-sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing (CVE-2026-54284)
    * python3.12-sqlparse: Denial of Service via inefficient SQL parsing (CVE-2026-59893)
    * python3.12-sqlparse: Denial of Service via quadratic CPU consumption in comment grouping     (CVE-2026-71491)
    * receptor: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
    * receptor: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
    * receptor: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
    * receptor: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
    * receptor: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
    * receptor: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71114 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: GitPython: Remote Code Execution via Git directory impersonation (CVE-2026-87817)
    * automation-controller: Job template enumeration via unauthenticated Bitbucket webhook oracle     (CVE-2026-84717)
    * automation-controller: Command argument injection via SystemJob extra_vars (CVE-2026-84724)
    * automation-controller: Masked credential data disclosure via workflow job node artifact search     (CVE-2026-84720)
    * automation-controller: Instance-group privilege escalation via workflow job template copy     (CVE-2026-84719)
    * automation-controller: Audit log falsification via unrestricted X-Forwarded-For trust (CVE-2026-84718)
    * automation-controller: Mesh certificate issuance for arbitrary hostnames via install bundle     (CVE-2026-84716)
    * automation-controller: Template injection via sanitize_jinja regex bypass (CVE-2026-84714)
    * automation-controller: Automation mesh topology disclosure via unauthenticated ping endpoint     (CVE-2026-84712)
    * automation-controller: Arbitrary file read via Project scm_branch git argument injection     (CVE-2026-84711)
    * automation-controller: Denial of service via credential type injector Jinja rendering (CVE-2026-84709)
    * automation-controller: Control-plane secret exposure via container group pod spec override     (CVE-2026-84708)
    * automation-controller: Unauthorized job output disclosure via host filter query traversal     (CVE-2026-84707)
    * automation-controller: Code execution via credential type environment-injector blocklist bypass     (CVE-2026-84706)
    * automation-controller: Cross-tenant credential exposure via execution environment binding     (CVE-2026-84703)
    * automation-controller: Cross-tenant execution privilege bypass via workflow job template node patch     (CVE-2026-84692)
    * automation-controller: Secret key and database credential disclosure via format-string injection     (CVE-2026-84691)
    * automation-controller: Cross-tenant job hijack via Bulk Job Launch node reference (CVE-2026-84689)
    * automation-controller: Credential token disclosure via notification template type-switch replay     (CVE-2026-84686)
    * automation-controller: Privilege escalation via constructed inventory attachment (CVE-2026-84684)
    * automation-controller: Stored cross-site scripting via ANSI hyperlink sequence in job output     (CVE-2026-84683)
    * automation-controller: Credential-use privilege escalation via organization Galaxy credential attachment     (CVE-2026-84680)
    * automation-controller: Arbitrary environment variable injection via AWX_TASK_ENV setting     (CVE-2026-84679)
    * automation-controller: Code execution via GALAXY_TASK_ENV environment variable injection     (CVE-2026-84678)
    * automation-controller: Server-side request forgery via Thycotic Secret Server credential test     (CVE-2026-84644)
    * automation-controller: Cross-organization credential exposure via Project signature-validation binding     (CVE-2026-84643)
    * automation-controller: Instance-group privilege escalation via Schedule and workflow node attachment     (CVE-2026-84638)
    * automation-controller: Remote code execution via Project scm_url git argument injection (CVE-2026-84502)
    * automation-controller: Survey password disclosure via validation error message (CVE-2026-84499)
    * automation-controller: Privilege escalation via provisioning-callback host-match bypass (CVE-2026-84474)
    * automation-controller: Instance-group privilege escalation via Bulk Job Launch permission check     (CVE-2026-84470)
    * automation-controller: awx: Privilege escalation to OpenShift namespace via pod_spec_override injection     in container groups (CVE-2026-75884)
    * automation-controller: Command-line argument injection via ad hoc command limit field (CVE-2026-71465)
    * automation-controller: Git argument-injection guard bypass via Schedule scm_branch prompt     (CVE-2026-71464)
    * automation-controller: Stack trace disclosure via notification-template Jinja whitelist bypass     (CVE-2026-71463)
    * automation-controller: Filesystem path-existence oracle via CUSTOM_VENV_PATHS validation     (CVE-2026-71462)
    * automation-controller: Cross-tenant job event data exposure via missing RBAC check (CVE-2026-71459)
    * automation-controller: Cross-tenant resource enumeration via Named-URL 404 response oracle     (CVE-2026-71458)
    * automation-controller: Unrestricted subscription and license information disclosure (CVE-2026-71460)
    * automation-controller: GitPython: Arbitrary code execution via command injection due to unguarded Git     options (CVE-2026-67323)
    * automation-controller: GitPython: Command Injection via Git option prefix abbreviation (CVE-2026-67325)
    * automation-controller: GitPython: Environment variable exfiltration via attacker-controlled clone URL     (CVE-2026-67322)
    * automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF     (CVE-2026-12564)
    * automation-gateway: brace-expansion: Denial of Service via unbounded intermediate arrays     (CVE-2026-69152)
    * automation-gateway: PostCSS: Information disclosure via crafted sourceMappingURL (CVE-2026-69153)
    * automation-gateway: js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869)
    * automation-gateway-proxy: Golang MIME: Denial of Service via maliciously-crafted MIME header     (CVE-2026-42504)
    * automation-gateway-proxy: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
    * automation-gateway-proxy: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)
    * automation-gateway-proxy: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)
    * automation-gateway-proxy: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
    * python3.12-gitpython: Remote Code Execution via Git directory impersonation (CVE-2026-87817)
    * python3.12-sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing (CVE-2026-54284)
    * python3.12-sqlparse: Denial of Service via inefficient SQL parsing (CVE-2026-59893)
    * python3.12-sqlparse: Denial of Service via quadratic CPU consumption in comment grouping     (CVE-2026-71491)
    * receptor: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
    * receptor: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
    * receptor: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
    * receptor: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
    * receptor: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
    * receptor: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59136 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: notification backends allow SSRF and credential leakage (CVE-2026-71366)
    * automation-controller: webhook status callback SSRF leaks the Git PAT (CVE-2026-71365)
    * automation-controller: project archive extraction allows path traversal file writes (CVE-2026-71364)
    * automation-controller: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade (CVE-2026-69243)
    * automation-controller: AIOHTTP: Denial of Service via malformed HTTP responses (CVE-2026-69244)
    * automation-controller: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886)
    * automation-controller: path traversal via YAML !include directive (CVE-2026-52902)
    * automation-controller: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()     (CVE-2026-34993)
    * automation-controller: daphne: Denial of Service via excessive WebSocket message size (CVE-2026-44545)
    * automation-controller: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
    * automation-platform-ui: form-data: Form field override via CRLF injection (CVE-2026-12143)
    * automation-platform-ui: path Traversal via unsanitized prefix/postfix enables directory escape     (CVE-2026-44705)
    * python-django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)
    * python3.12-aiohttp: HTTP Request Smuggling via WebSocket Upgrade (CVE-2026-69243)
    * python3.12-aiohttp: Denial of Service via malformed HTTP responses (CVE-2026-69244)
    * python3.12-django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)
    * python3.12-gitpython: Command Injection via Git option prefix abbreviation (CVE-2026-67325)
    * python3.12-gitpython: Arbitrary Code Execution via Joined Short Options Bypass (CVE-2026-67324)
    * python3.12-gitpython: Arbitrary code execution via command injection due to unguarded Git options     (CVE-2026-67323)
    * python3.12-gitpython: Environment variable exfiltration via attacker-controlled clone URL     (CVE-2026-67322)
    * python3.12-gitpython: Arbitrary file overwrite and read via unsafe git option forwarding     (CVE-2026-73620)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4072-1 advisory.

    - CVE-2026-42215: command injection via Git options bypass (bsc#1264604).
    - CVE-2026-42284: unsafe option check validates multi_options before shlex.split transforms it     (bsc#1264605).
    - CVE-2026-44243: path traversal in GitPython reference APIs allows arbitrary file write and delete     outside the       repository (bsc#1264606).
    - CVE-2026-44244: newline injection in config_writer().set_value() enables RCE via core.hooksPath     (bsc#1264608).
    - CVE-2026-67322: vulnerable to environment-variable exfiltration in Repo.clone_from() (bsc#1273357).
    - CVE-2026-67323: fails to guard against dangerous Git options passed as keyword arguments in     Repo.archive() and       git.ls_remote() (bsc#1273358).
    - CVE-2026-67325: contains an incomplete command injection blocklist that fails to account for git's long-     option prefix       abbreviation feature (bsc#1273359).
    - CVE-2026-67326: fails to validate newline characters in the section parameter of config_writer()     (bsc#1273364).
    - CVE-2026-69097: fails to properly escape section names in git config files, allowing attackers to inject     arbitrary       configuration directives through malicious submodule names (bsc#1273414).
    - CVE-2026-73619: incomplete denylist in the `unsafe_git_archive_options` guard that omits `--add-file`     and `--add-       virtual-file` options can lead to arbitrary file reads (bsc#1275755).
    - CVE-2026-73620: failure to guard git option forwarding in `IndexFile.checkout()` and     `TagReference.create()` can lead       to arbitrary file reads and writes (bsc#1275756).
    - CVE-2026-73621: argument injection in the `Commit.count()` method allows for destruction/blanking of     arbitrary files       (bsc#1275757).
    - CVE-2026-73622: failure to disable environment variable expansion in `Remote.create()` and     `Submodule.add()` URL       handling allows for secret exfiltration via URLs containing variable references (bsc#1275751).
    - CVE-2026-73623: incomplete denylist in `unsafe_git_clone_options` that omits `--template` allows for     arbitrary command       execution (bsc#1275752).
    - CVE-2026-73624: `Diffable.diff` method fails to validate git options passed through `kwargs`, which can     lead to       arbitrary file writes (bsc#1275753).
    - CVE-2026-73625: `check_unsafe_options` guard bypass via smuggling of git options inside single-character     `kwarg`       values can lead to arbitrary code execution (bsc#1275754).
    - CVE-2026-76217: failure to validate options passed to `git rm` and `git checkout` commands in     `IndexFile.remove()` and       `Head.checkout()` can lead to arbitrary file reads (bsc#1275745).
    - CVE-2026-76218: unguarded git option forwarding in `Repo.init` allows for arbitrary command execution     (bsc#1275746).
    - CVE-2026-76219: unguarded `git read-tree` option forwarding in `IndexFile.from_tree/reset/merge_tree`     can lead to       arbitrary file overwrites (bsc#1275747).
    - CVE-2026-76220: `check_unsafe_options` guard can be bypassed by combining a single-character `kwarg`     with       `split_single_char_options=False`, which can lead to arbitrary OS command injection (bsc#1275748).
    - CVE-2026-76221: `config-name` injection in the `option-name` validator can lead to remote code execution       (bsc#1275749).
    - CVE-2026-76222: failure to validate submodule names from `.gitmodules` files allows creation of Git     repositories at       arbitrary filesystem paths outside the intended clone directory (bsc#1275750).
    - CVE-2026-78675: fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose     local file       content by including arbitrary file paths via [include] directives (bsc#1276434).
    - CVE-2026-78676: fails to safely re-serialize multi-line git-config values during write operations,     corrupting dormant       quoted values into injected directives (bsc#1276433).
    - CVE-2026-78677: allowing creation of arbitrary git directories outside the intended clone destination     (bsc#1276432).
    - CVE-2026-78678: an incomplete denylist in the unsafe_git_revision_options guard that omits --contents     and -S options,       allowing attackers to read arbitrary files (bsc#1276431).
    - CVE-2026-78679: an arbitrary file read vulnerability in TagReference.create() (bsc#1276430).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4872 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4872-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Emmanuel Arias     October 31, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-git     Version        : 3.1.30-1+deb12u3     CVE ID         : CVE-2026-42215 CVE-2026-42284 CVE-2026-44243 CVE-2026-44244                      CVE-2026-67322 CVE-2026-67323 CVE-2026-67324 CVE-2026-67325                      CVE-2026-67326 CVE-2026-69097 CVE-2026-73619 CVE-2026-73620                      CVE-2026-73621 CVE-2026-73622 CVE-2026-73623 CVE-2026-73624                      CVE-2026-73625 CVE-2026-76217 CVE-2026-76218 CVE-2026-76219                      CVE-2026-76220 CVE-2026-76221 CVE-2026-76222 CVE-2026-78675                      CVE-2026-78676 CVE-2026-78677 CVE-2026-78678 CVE-2026-78679                      CVE-2026-87817 CVE-2026-87818 CVE-2026-87819 CVE-2026-100689                      CVE-2026-110855 CVE-2026-110856 CVE-2026-110857 CVE-2026-110858                      CVE-2026-110859 CVE-2026-110860 CVE-2026-114145     Debian Bug     : 1135349 1135350 1143454 1143602 1144344 1144929

    Multiple security vulnerabilities were discovered in python-git     (GitPython), a Python library used to interact with git repositories.
    These issues could result in arbitrary command execution, path traversal     with arbitrary file read or write, git config injection, leaking of     secrets through environment variable expansion or denial of service     (ReDoS).

    CVE-2026-42215

        Unsafe options passed as underscored keyword arguments were not         blocked, which could lead to command execution.

    CVE-2026-42284

        Unsafe options were not checked after splitting multi_options with         shlex, which could lead to command execution.

    CVE-2026-44243

        When manipulating references, access to files outside the repository         was not prevented, allowing arbitrary file access.

    CVE-2026-44244

        The config writer did not reject control characters in config values,         allowing config injection.

    CVE-2026-67322

        Environment variables were expanded in clone URLs, which could leak         secrets to a remote host.

    CVE-2026-67323

        Unsafe options (--exec, --upload-pack, ...) were not guarded in the         archive, fetch, pull, push, ls-remote, blame and revision APIs, which         could lead to command execution.

    CVE-2026-67324

        Abbreviated long options bypassed the unsafe option checks, leading to         command execution.

    CVE-2026-67325

        Joined short options bypassed the unsafe option checks, leading to         command execution.

    CVE-2026-67326

        Config section names were not validated before writing, allowing         config injection.

    CVE-2026-69097

        Config section names containing an unquoted closing bracket could         inject arbitrary settings into .git/config.

    CVE-2026-73619

        The --add-file, --add-virtual-file (archive) and --bundle-uri (clone)         options were missing from the unsafe option lists, which could lead to         command execution or arbitrary file access.

    CVE-2026-73620

        Unsafe options in IndexFile.checkout() (--prefix) and         TagReference.create() (-F/--file) were not blocked, which could write         to or read from arbitrary filesystem paths.

    CVE-2026-73621

        Unsafe output options were not rejected in Commit.count, which could         write to arbitrary filesystem paths.

    CVE-2026-73622

        Environment variables were expanded in remote and submodule URLs,         which could leak secrets to a remote host.

    CVE-2026-73623

        The unsafe --template option was not rejected when cloning, which         could read from arbitrary filesystem paths.

    CVE-2026-73624

        Unsafe output options were not guarded in diff operations, which could         write to arbitrary filesystem paths.

    CVE-2026-73625

        The values of split short options were not validated, which could         bypass the unsafe option checks in clone, remote, revision, blame and         archive operations.

    CVE-2026-76217

        The --pathspec-from-file options were not guarded in IndexFile.remove,         Head.checkout and HEAD.reset, which could read from arbitrary         filesystem paths.

    CVE-2026-76218

        Unsafe git init options (--template, --separate-git-dir) were not         guarded in Repo.init, which could read from or write to arbitrary         filesystem paths.

    CVE-2026-76219

        The --index-output option was not guarded in read-tree calls made by         from_tree, merge_tree and reset, which could write to an arbitrary         path.

    CVE-2026-76220

        The value joined to one-character options was not checked when         split_single_char_options is false, which could bypass the unsafe         option checks.

    CVE-2026-76221

        Config option names containing characters that could inject arbitrary         settings when writing the config were not rejected.

    CVE-2026-76222

        Submodule names read from .gitmodules were not validated before         filesystem operations, allowing path traversal outside the repository.

    CVE-2026-78675

        Include directives in .gitmodules were processed, which could read         arbitrary files.

    CVE-2026-78676

        Multiline config values were not preserved when writing, which could         inject new options into the config.

    CVE-2026-78677

        The --separate-git-dir option was not blocked in Repo.clone() and         Repo.clone_from(), which could write repository metadata to an         arbitrary path.

    CVE-2026-78678, CVE-2026-78679

        File-reading options were not blocked in blame, diff and tag APIs,         which could read arbitrary files.

    CVE-2026-87817

        Repository discovery did not prefer the .git entry nor validate         candidate git directories, diverging from git's behaviour.

    CVE-2026-87818

        The --no-index option was not treated as an unsafe diff option, which         allowed diffing arbitrary filesystem paths.

    CVE-2026-87819

        Actor identities were parsed with regular expressions, allowing         quadratic backtracking (ReDoS) on malformed identities.

    CVE-2026-100689

        Submodule checkout paths that resolve outside the repository or         through a symbolic link were not rejected in Submodule.update, unlike         in add and move.

    CVE-2026-110855

        Environment variables were expanded in the separate_git_dir path when         cloning, so repository metadata could be written to an unexpected         location.

    CVE-2026-110856

        Actor identities and dates in commit authors, committers and taggers         were parsed with backtracking regular expressions, allowing excessive         CPU use (ReDoS) on malformed metadata.

    CVE-2026-110857

        The unsafe option and protocol checks were incomplete in         Git.ls_remote(), Repo.merge_base() and IndexFile.move(), which omitted         guards already used by sibling APIs.

    CVE-2026-110858

        Option-shaped remote names were not rejected in Remote.update(), which         git forwards to fetch --multiple without an option terminator,         allowing a leading-dash name to change the requested operation.

    CVE-2026-110859

        The positional reference passed by Head.checkout() was not validated         against the unsafe-option policy, so reference names originating in a         cloned repository could bypass it.

    CVE-2026-110860

        Submodule checkout, move and metadata paths that traverse intermediate         symbolic links were not rejected before performing filesystem         operations.

    CVE-2026-114145

        GitPython validated a submodule's '.git' path only after cloning into         it, which could lead to remote code execution.

    For Debian 12 bookworm, these problems have been fixed in version     3.1.30-1+deb12u3.

    We recommend that you upgrade your python-git packages.

    For the detailed security status of python-git please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-git

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in     Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack     (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check     for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate     an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these     methods. (CVE-2026-67323)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59135 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: notification backends allow SSRF and credential leakage (CVE-2026-71366)
    * automation-controller: webhook status callback SSRF leaks the Git PAT (CVE-2026-71365)
    * automation-controller: project archive extraction allows path traversal file writes (CVE-2026-71364)
    * automation-controller: AIOHTTP: Denial of Service via malformed HTTP responses (CVE-2026-69244)
    * automation-controller: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886)
    * automation-controller: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()     (CVE-2026-34993)
    * automation-controller: path traversal via YAML !include directive (CVE-2026-52902)
    * automation-controller: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
    * automation-gateway: path Traversal via unsanitized prefix/postfix enables directory escape     (CVE-2026-44705)
    * python3.12-aiohttp: HTTP Request Smuggling via WebSocket Upgrade (CVE-2026-69243)
    * python3.12-aiohttp: Denial of Service via malformed HTTP responses (CVE-2026-69244)
    * python3.12-django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)
    * python3.12-gitpython: Command Injection via Git option prefix abbreviation (CVE-2026-67325)
    * python3.12-gitpython: Arbitrary Code Execution via Joined Short Options Bypass (CVE-2026-67324)
    * python3.12-gitpython: Arbitrary code execution via command injection due to unguarded Git options     (CVE-2026-67323)
    * python3.12-gitpython: Environment variable exfiltration via attacker-controlled clone URL     (CVE-2026-67322)
    * python3.12-gitpython: Arbitrary file overwrite and read via unsafe git option forwarding     (CVE-2026-73620)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
458677	Echo: python-git: security update to 3.1.51	Tenable Cloud Security	Echo Local Security Checks	10/2/2026	10/16/2026	high
458677	Echo: python-git: security update to 3.1.51	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/2/2026	10/16/2026	high
349536	RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Critical) (RHSA-2026:71113)	Nessus	Red Hat Local Security Checks	9/23/2026	9/25/2026	high
349628	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Critical) (RHSA-2026:71114)	Nessus	Red Hat Local Security Checks	9/24/2026	9/25/2026	high
339179	RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:59136)	Nessus	Red Hat Local Security Checks	8/25/2026	9/18/2026	critical
348443	SUSE SLED15 / SLES15 Security Update : python-GitPython (SUSE-SU-2026:4072-1)	Nessus	SuSE Local Security Checks	9/21/2026	9/21/2026	critical
374599	Debian dla-4872 : python-git-doc - security update	Nessus	Debian Local Security Checks	10/31/2026	10/31/2026	critical
331621	Linux Distros Unpatched Vulnerability : CVE-2026-67323	Nessus	Misc.	8/2/2026	10/31/2026	high
339184	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:59135)	Nessus	Red Hat Local Security Checks	8/25/2026	9/18/2026	critical

Detections

Analytics

Plugins Search

high

high

high

high

critical

critical

critical

high

critical