Product
GitPython Configuration-Name Injection Vulnerability
2 TTPs 1 CVEGitPython versions prior to 3.1.58 are vulnerable to configuration-name injection, allowing attackers to forge arbitrary git-config directives and execute commands via core.sshCommand or core.hooksPath.
Path Traversal in GitPython via Malicious Submodule Names
1 TTP 1 CVEGitPython fails to validate submodule names defined in .gitmodules files, allowing attackers to perform path traversal and create arbitrary Git repositories outside the intended working tree during submodule initialization.
Command Injection Vulnerability in GitPython
1 TTP 1 CVEGitPython versions prior to 3.1.51 are vulnerable to command injection because the library's security blocklist fails to account for Git command-line option abbreviation, allowing attackers to execute arbitrary commands.
GitPython Vulnerability Allows Arbitrary Code Execution via Git Hooks
2 rules 1 TTP 1 CVEA vulnerability in GitPython versions prior to 3.1.47 allows for command execution during repository cloning by manipulating the `multi_options` parameter to inject malicious Git configurations, such as `core.hooksPath`, leading to the execution of attacker-controlled hooks.