Arbitrary Argument InjectionGitPython is a python library used to interact with Git repositories
Affected versions of this package are vulnerable to Arbitrary Argument Injection through the high-level diff API in git/diff.py and git/repo/base.py. An attacker can turn repo.index.diff(..., no_index=True) into a blind local-file content oracle by supplying --no-index together with attacker-chosen paths and an -I/--ignore-matching-lines pattern. This lets the child git process treat the supplied operands as arbitrary filesystem paths, exposing local file content through distinguishable success-or-error responses and allowing repeated queries to recover secrets readable by the process running GitPython.
How to fix Arbitrary Argument Injection? Upgrade GitPython to version 3.1.60 or higher.
| |
Arbitrary Code InjectionGitPython is a python library used to interact with Git repositories
Affected versions of this package are vulnerable to Arbitrary Code Injection through Repo.__init__ and is_git_dir in git/repo/base.py and git/repo/fun.py. An attacker can execute arbitrary commands by supplying a repository whose tracked root files make GitPython treat the working-tree root as the git directory and then placing a malicious hooks/pre-commit there. When a victim opens or clones that repository and later calls repo.index.commit(), GitPython resolves the hook path inside attacker-controlled content instead of the real .git directory. That causes the pre-commit hook to run in the victim’s process, breaking the integrity of local repository operations.
Workarounds
- Do not open or clone untrusted repositories with GitPython unless you trust their tracked root files; attacker-controlled
HEAD, gitdir, commondir, and hooks/ content can be treated as repository metadata and lead to hook execution.
- Avoid calling
repo.index.commit() on repositories sourced from untrusted content; this is the operation that can execute a malicious tracked hooks/pre-commit in the victim process.
How to fix Arbitrary Code Injection? Upgrade GitPython to version 3.1.60 or higher.
| |
Regular Expression Denial of Service (ReDoS)GitPython is a python library used to interact with Git repositories
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the Actor._from_string parsing in git/util.py. An attacker can exhaust CPU and stall commit metadata access by supplying a crafted commit object whose author or committer header contains a long unterminated < delimiter. When GitPython reads .author or .committer from that commit, the backtracking in Actor.name_email_regex can block single-threaded processing for an extended time, causing denial of service for services that scan or display untrusted repositories.
How to fix Regular Expression Denial of Service (ReDoS)? Upgrade GitPython to version 3.1.60 or higher.
| |
