A long weekend's worth of advisories, and none of them are in a model runtime. GitPython is the headline — a 9.3 critical and six highs across two batches, all variations on git options reaching the subprocess that were supposed to be filtered out. Angular ships three highs the same morning, and v19 doesn't get a release. Underneath both, cryptography, undici, aiohttp and ip-address all moved: the plumbing AI tooling sits on, rather than the tooling itself.

Worth your morning

GitPython — one critical, six highs, one family. Two batches, August 1 and August 3, and they describe the same problem from seven angles: GitPython accepts caller-supplied arguments and forwards them to git, and the guard meant to stop the dangerous ones kept missing entries. CVE-2026-67324 (9.3) is the one to action first — Repo.clone_from() with allow_unsafe_options=False didn't recognise joined short-option forms, so the setting that exists to refuse helper commands didn't refuse them. The highs around it cover the same shape: an incomplete command-injection blocklist (CVE-2026-67325), unguarded options passed as keyword arguments (CVE-2026-67323), environment-variable exfiltration through clone_from() (CVE-2026-67322), and — in Monday's batch — GHSA-3f7w-8rr8-f37f (8.1), where IndexFile.checkout() writes outside the intended directory and TagReference.create() reads a file back to the caller through the tag message.

The August 1 items fix in 3.1.51; the August 3 items fix in 3.1.57. Go to 3.1.57 and don't reason about which subset applies to you.

This matters more than its install count suggests, because GitPython is rarely a direct dependency. It arrives under MLflow, DVC, and the growing pile of coding agents and evaluation harnesses that clone a repository someone else named. If any of your tooling takes a repository URL or a ref from a user, a model, or a config file you don't control, that's the path worth checking today.

Angular — three highs, and v19 is on its own. All three land in the 21.2.19 / 20.3.27 line. CVE-2026-68945 (8.8) is the highest and the most operationally awkward: HttpTransferCache joined repeated query parameters with commas when building cache keys, so genuinely different requests collided on one key and a response could be served to a request that didn't make it. On an SSR app with credentialed requests that's a cross-user disclosure, not a caching nuisance. CVE-2026-69149 (8.6) is missing escaping in the SSR serializer for fallback raw-content elements, and CVE-2026-69151 (7.6) is the i18n pipeline marking event-handler attributes as translatable when the standard validation path rejects them — so a localized build could carry something the same template wouldn't have compiled.

The part to plan around: the fixed versions are 22.0.x, 21.2.19 and 20.3.27, and the affected range runs to ≤ 19.2.25 with no v19 release behind it. If you're on Angular 19 there is no patch coming through npm for these three. That's an upgrade to schedule this quarter, not a bump to apply this morning.

The layer underneath. Four more, all boring in isolation and all worth the version bump. cryptography needs 50.0.0 to clear both highs — CVE-2026-69249 (8.7) is exponential path-building on certificate chains with duplicate self-signed intermediates, an amplification pathway over data that is often user-supplied, and CVE-2026-69247 (8.2) is a Bleichenbacher oracle in PKCS#7 decryption, which only bites if you auto-decrypt untrusted EnvelopedData at volume. undici takes five, of which CVE-2026-13697 (7.4) is the high: malformed qualified private cache directives get stored in the shared cache and served to the next caller. That's the HTTP client under Node's fetch, so it's under most of the JS SDKs whether or not you installed it deliberately. aiohttp CVE-2026-69244 (7.1) is an out-of-bounds read in the C parser's error path — a malicious server can crash the client — and if you can't move to 3.14.3 today, AIOHTTP_NO_EXTENSIONS=1 switches to the unaffected Python parser.

And ip-address CVE-2026-69192 (7.7), which is the third digest running where the thing that failed was a library whose only job is deciding whether an address is internal. This one read leading-zero octets as decimal while every resolver downstream read them as octal, so the classifier and the socket disagreed about where the request was going. Fixed in 10.3.1. Same standing advice as the dssrf items last week: if this library is the control between an agent's fetch tool and your metadata endpoint, it's load-bearing and it should not be the only layer.

Standing items. The .NET gap has closed — the July servicing advisories are now in the GitHub Advisory Database, including CVE-2026-50524 and eight siblings across the July 20–28 window, so Dependabot and SCA tooling on the GitHub feed will see them again. Nothing to do beyond confirming you're on the July release. The llama.cpp JSON-schema-to-grammar denial-of-service pair (CVE-2026-17500, CVE-2026-17501) is unpatched for an eighth day, though PR #25308 moved yesterday for the first time since July 19 — the discussion is now about whether the CVE severities are right given the project's position that llama-server shouldn't face untrusted networks, not about whether the guards are correct. Keep schema input inside your trust boundary. And primeng remains archived with no repository that can issue a security fix.