Lack of data validation In gitpython
Description
GitPython vulnerable to Remote Code Execution due to improper user input validation All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 pypi | 3.1.30 | ||
 debian 12 | 3.1.30-1 | ||
debian 11 | 3.1.14-1+deb11u1 | ||
debian 13 | 3.1.30-1 | ||
debian 14 | 3.1.30-1 |
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15.