Iniciar sesión
Deutsch English Español Polski
Crítica

GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

  • Publicada: 11.08.2023
  • Actualizado: 11.10.2026 12:19

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from, making it vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Python (PyPI) gitpython < 3.1.32 3.1.32

Referencias

Puntuación CVSS 9.8/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Debilidad (CWE)
CWE-78
Plataforma
Python (PyPI)
Paquete
gitpython
Publicada
11.08.2023
Actualizado
11.10.2026 12:19

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2023-137 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-pr76-5cm5-w9cj - CC BY 4.0

Historial de vulnerabilidades: gitpython

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (37) en el archivo
Entradas en total
37
Primera → última
12.2022 09.2026
Sin corrección
0
Explotada en ataques
0

Distribución por gravedad

  • Crítica 3
  • Alta 26
  • Media 8

Divulgaciones por año

Gravedad:
  1. GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
    Alta · 7.5 CVE-2026-87819 < 3.1.60 3.1.60
  2. GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
    Alta · 8.8 CVE-2026-87817 < 3.1.60 3.1.60
  3. GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
    Crítica · 9.8 CVE-2026-78676 < 3.1.59 3.1.59
  4. GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
    Alta · 7.5 CVE-2026-78677 < 3.1.59 3.1.59
  5. GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)
    Alta · 8.4 CVE-2026-78675 < 3.1.59 3.1.59
  6. GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
    Alta · 8.8 CVE-2026-76220 < 3.1.58 3.1.58
  7. GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
    Alta · 8.8 CVE-2026-76221 < 3.1.58 3.1.58
  8. GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
    Alta · 8.2 CVE-2026-76222 < 3.1.58 3.1.58
  9. GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
    Alta · 7.5 CVE-2026-76218 < 3.1.58 3.1.58
  10. GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
    Alta · 8.1 CVE-2026-76219 < 3.1.58 3.1.58
  11. GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
    Alta · 8.1 CVE-2026-73620 < 3.1.57 3.1.57
  12. GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
    Alta · 7.5 CVE-2026-73622 < 3.1.55 3.1.55
  13. GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
    Alta · 8.8 CVE-2026-73625 < 3.1.54 3.1.54
  14. GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
    Alta · 7.5 CVE-2026-73623 < 3.1.54 3.1.54
  15. GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
    Alta · 8.1 CVE-2026-73624 < 3.1.54 3.1.54
  16. GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
    Alta · 7.0 CVE-2026-69097 < 3.1.53 3.1.53
  17. GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
    Alta · 7.5 CVE-2026-67322 < 3.1.52 3.1.52
  18. GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
    Alta · 8.4 CVE-2026-67323 < 3.1.51 3.1.51
  19. GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
    Alta · 8.8 CVE-2026-67325 < 3.1.51 3.1.51
  20. GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes atta
    Alta CVE-2026-67324 >= 3.1.50, < 3.1.51 3.1.51
  21. GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
    Alta · 7.0 CVE-2026-67326 < 3.1.50 3.1.50
  22. GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
    Alta · 7.8 CVE-2026-44244 < 3.1.49 3.1.49
  23. GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
    Alta · 7.1 CVE-2026-44243 < 3.1.48 3.1.48
  24. GitPython has Command Injection via Git options bypass
    Alta · 8.8 CVE-2026-42215 >= 3.1.30, < 3.1.47 3.1.47
  25. GitPython: Unsafe option check validates multi_options before shlex.split transformation
    Alta · 8.1 CVE-2026-42284 < 3.1.47 3.1.47
  26. Untrusted search path under some conditions on Windows allows arbitrary code execution
    Alta · 7.8 CVE-2024-22190 < 3.1.41 3.1.41
  27. GitPython untrusted search path on Windows systems leading to arbitrary code execution
    Alta · 7.8 CVE-2023-40590 < 3.1.33 3.1.33
  28. GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments esta entrada
    Crítica · 9.8 CVE-2023-40267 < 3.1.32 3.1.32
  29. All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone
    Crítica · 8.1 CVE-2022-24439 < 3.1.30 3.1.30

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.