Skip to content
Threat Feed
Subscribe

Product

GitPython (<= 3.1.57)

2 briefs RSS
high advisory

Path Traversal in GitPython via Malicious Submodule Names

GitPython fails to validate submodule names defined in .gitmodules files, allowing attackers to perform path traversal and create arbitrary Git repositories outside the intended working tree during submodule initialization.

GitPython +1 remote-code-execution input-validation python
1t 1c
high advisory

GitPython Command Injection via Unsafe Git Option Guard Bypass

A bypass of the GitPython safety guard allows arbitrary OS command execution via token smuggling when using single-character keyword arguments with split_single_char_options=False.

GitPython execution library-vulnerability command-injection remote-code-execution injection supply-chain
2t