VDB
Sign up
CRITICAL9.8

PYSEC-2022-42992

Quick fix

PYSEC-2022-42992 — gitpython: upgrade to the fixed version with the command below.

pip install --upgrade 'gitpython>=3.1.30'

Details

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/gitpython
Introduced in: 0Fixed in: 3.1.30
Fixpip install --upgrade 'gitpython>=3.1.30'

References