gitpython 3.1.54

Direct Vulnerabilities

Known vulnerabilities in the gitpython package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H External Control of File Name or Path GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path in the `Repo.archive`. An attacker can access arbitrary files on the filesystem by supplying specially crafted options that are not properly denied by the existing guard, such as `--add-file` or `--add-virtual-file`, which allow reading files outside the intended repository and including their contents in the generated archive. How to fix External Control of File Name or Path? Upgrade `GitPython` to version 3.1.57 or higher.	[,3.1.57)
M External Control of File Name or Path GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path in the `Repo.archive`. An attacker can access arbitrary files on the filesystem by supplying specially crafted options that are not properly denied by the existing guard, such as `--add-file` or `--add-virtual-file`, which allow reading files outside the intended repository and including their contents in the generated archive. How to fix External Control of File Name or Path? Upgrade `GitPython` to version 3.1.57 or higher.	[,3.1.57)
H External Control of File Name or Path GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path via the forwarding of unguarded options in the `checkout` and `create` functions. An attacker can overwrite arbitrary files or read arbitrary files by supplying crafted arguments to these functions, which are then passed directly to underlying git commands without proper validation. How to fix External Control of File Name or Path? Upgrade `GitPython` to version 3.1.57 or higher.	[,3.1.57)
M Arbitrary Argument Injection GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the `Commit.count` function. An attacker can cause arbitrary files to be truncated to zero bytes by injecting the `output` argument, leading to loss of data integrity and availability. How to fix Arbitrary Argument Injection? Upgrade `GitPython` to version 3.1.56 or higher.	[,3.1.56)
H Information Exposure GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Information Exposure in the `Repo.create_remote` process when attacker-controlled URLs are passed and environment variables are expanded into the URL. An attacker can obtain sensitive environment secrets by supplying a crafted URL containing environment variable references, which are then expanded and stored in configuration files and transmitted to attacker-controlled servers during subsequent network operations. How to fix Information Exposure? Upgrade `GitPython` to version 3.1.55 or higher.	[,3.1.55)

Vulnerability

Vulnerable Version

External Control of File Name or Path