gitpython@3.1.52

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to External Control of File Name or Path in the Repo.archive. An attacker can access arbitrary files on the filesystem by supplying specially crafted options that are not properly denied by the existing guard, such as --add-file or --add-virtual-file, which allow reading files outside the intended repository and including their contents in the generated archive.

Upgrade GitPython to version 3.1.57 or higher.

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to External Control of File Name or Path via the forwarding of unguarded options in the checkout and create functions. An attacker can overwrite arbitrary files or read arbitrary files by supplying crafted arguments to these functions, which are then passed directly to underlying git commands without proper validation.

Upgrade GitPython to version 3.1.57 or higher.

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Arbitrary Argument Injection via the Commit.count function. An attacker can cause arbitrary files to be truncated to zero bytes by injecting the output argument, leading to loss of data integrity and availability.

Upgrade GitPython to version 3.1.56 or higher.

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') through improper sanitization of section or subsection names in configuration headers. An attacker can inject arbitrary configuration directives by supplying specially crafted submodule names, leading to the execution of malicious commands during subsequent git operations.

Upgrade GitPython to version 3.1.53 or higher.

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Information Exposure in the Repo.create_remote process when attacker-controlled URLs are passed and environment variables are expanded into the URL. An attacker can obtain sensitive environment secrets by supplying a crafted URL containing environment variable references, which are then expanded and stored in configuration files and transmitted to attacker-controlled servers during subsequent network operations.

Upgrade GitPython to version 3.1.55 or higher.

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Arbitrary Argument Injection via the diff process. An attacker can overwrite or corrupt arbitrary files with attacker-influenced diff content by injecting malicious arguments into the other parameter or by supplying crafted keyword arguments, leading to unauthorized file modification at the process privilege level.

Upgrade GitPython to version 3.1.54 or higher.

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the clone_from process. An attacker can execute arbitrary commands by supplying a crafted directory containing malicious hooks as the template parameter during a clone operation. This is only exploitable if the attacker can provide a directory with executable hooks accessible to the target system, such as through shared filesystems, upload directories, or attacker-writable network paths.

Upgrade GitPython to version 3.1.54 or higher.