Skip to content
Threat Feed
Subscribe

Product

GitPython

2 briefs RSS
high advisory

Command Injection Vulnerability in GitPython

GitPython versions prior to 3.1.51 are vulnerable to command injection because the library's security blocklist fails to account for Git command-line option abbreviation, allowing attackers to execute arbitrary commands.

GitPython vulnerability command-injection python
1t 1c
high advisory

GitPython Vulnerability Allows Arbitrary Code Execution via Git Hooks

A vulnerability in GitPython versions prior to 3.1.47 allows for command execution during repository cloning by manipulating the `multi_options` parameter to inject malicious Git configurations, such as `core.hooksPath`, leading to the execution of attacker-controlled hooks.

GitPython code-execution git-hooks command-injection
2r 1t 1c