Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
109
GitHub Actions
55
Go
4,553
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,518
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

20 advisories

Loading
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution High
GHSA-wvpp-8hx9-p66j was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE) High
GHSA-jm78-9fvv-mhgr was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use
GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks High
GHSA-9rj7-rf2p-w77r was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use and BarakSrour BarakSrour BarakSrour
GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite High
GHSA-4gmw-gg2m-w46p was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use and bhaswanthc bhaswanthc bhaswanthc
AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages() High
CVE-2026-16796 was published for bedrock-agentcore (pip) Jul 24, 2026
MrCloudSec Credited to MrCloudSec
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution High
GHSA-r9mr-m37c-5fr3 was published for GitPython (pip) Jul 24, 2026
manus-use Credited to manus-use
GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled) High
GHSA-fjr4-x663-mwxc was published for GitPython (pip) Jul 24, 2026
manus-use Credited to manus-use
GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()` High
GHSA-956x-8gvw-wg5v was published for GitPython (pip) Jul 21, 2026
miauzxw Credited to miauzxw
Linuxfabrik Monitoring Plugins: Sudoers may be able to obtain privilege escalation via /usr/bin/apt-get arguments High
CVE-2026-52817 was published for linuxfabrik-lib (pip) Jul 2, 2026
OoYo0uto Credited to OoYo0uto
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages() High
CVE-2026-12530 was published for bedrock-agentcore (pip) Jun 19, 2026
MrCloudSec Credited to MrCloudSec
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution High
CVE-2026-11332 was published for ansible-core (pip) Jun 5, 2026
Prefect has an Argument Injection issue High
CVE-2026-3515 was published for prefect (pip) May 26, 2026
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request High
CVE-2026-42266 was published for jupyterlab (pip) May 5, 2026
pmcao Credited to pmcao, Yann-P, and krassowski Yann-P Yann-P
krassowski krassowski
GitPython: Unsafe option check validates multi_options before shlex.split transformation High
CVE-2026-42284 was published for GitPython (pip) Apr 25, 2026
Texuguinho1234 Credited to Texuguinho1234
PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars High
CVE-2026-40113 was published for PraisonAI (pip) Apr 10, 2026
aswinastro Credited to aswinastro and g0w6y g0w6y g0w6y
Apache Airflow ODBC Provider Argument Injection vulnerability High
CVE-2023-34395 was published for apache-airflow-providers-odbc (pip) Jun 27, 2023
Poetry Argument Injection can lead to Local Code Execution High
CVE-2022-36069 was published for poetry (pip) Sep 16, 2022
paul-gerste-sonarsource Credited to paul-gerste-sonarsource and neersighted neersighted neersighted
Codecov does not sanitize gcov arguments High
CVE-2019-10800 was published for codecov (pip) Jul 14, 2022
Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate High
CVE-2022-23915 was published for Weblate (pip) Mar 4, 2022
dellalibera Credited to dellalibera
Arbitrary command execution on Windows via qutebrowserurl: URL handler High
CVE-2021-41146 was published for qutebrowser (pip) Oct 22, 2021
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database