cve-2024-32002-poc-rce

CVE-2024-32002 RCE POC POC для CVE-2024-32002, демонстрирующий удалённое выполнение кода RCE. См. cve-2024-32002-poc-rce для связанного репозитория подмодуля. Что содержит этот репозиторий Символическая ссылка с произвольным именем, указывающая на каталог .git. Файл .gitmodules, определяющий...

CVE-2023-51385_test

Vérifier CVE-2023-51385 Il faut d'abord ajouter le contenu suivant dans /.ssh/config host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Il y a une injection de commande dans l'instruction du fichier .gitmodules url = ssh://echo helloworld cve.txtfoo.example.com/bar Une...

CVE-2023-51385_test

Validation de CVE-2023-51385 Tout d'abord, ajoutez ce qui suit dans /.ssh/config Host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Il existe une injection de commande dans la déclaration du fichier .gitmodules url = ssh://echo helloworld cve.txtfoo.example.com/bar Une...

CVE-2017-1000117

CVE-2017-1000117 Comment ça marche ? $ git clone --recursive [email protected]:ikmski/CVE-2017-1000117.git Comment créer ce dépôt $ cat message.txt | gzip | base64 command $ git submodule add [email protected]:ikmski/Hello-World.git subs/CVE-2017-1000117 $ cat .gitmodules submodule...

CVE-2025-48384-test

Командная строка воспроизведения git clone --recursive https://github.com/beishanxueyuan/CVE-2025-48384-test.git Изменение указанного GitHub-репозитория git init repo git -C repo -c protocol.file.allow=always submodule add https://github.com/beishanxueyuan/CVE-2025-48384.git sub git -C repo mv su...

cve-2023-51385

Проверка CVE-2023-51385 Сначала необходимо добавить следующее содержимое в /.ssh/config: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p В файле .gitmodules присутствует инъекция команд в строке: url = ssh://echo helloworld cve.txtfoo.example.com/bar После настройки...

CVE-2026-55251

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2018-11235

CVE-2018-11235 Aperçu de la vulnérabilité Nom de la vulnérabilité : Vulnérabilité de sécurité Git Identifiant CNNVD : CNNVD-201805-1020 Niveau de gravité : Élevé Identifiant CVE : CVE-2018-11235 Type de vulnérabilité : Problème de caractéristique de sécurité Date de publication : 2018-05-31 Type ...

CVE-2017-1000117

CVE-2017-1000117 Des personnes malveillantes peuvent amener une victime à accéder à un lien « ssh://… » spécialement conçu, par exemple lors de l'exécution d'un programme, afin d'exécuter des commandes. Ce lien peut être placé dans le fichier .gitmodules d'un projet Git. Ainsi, lorsque la victime...

cve-2024-32002-poc

💥 CVE-2024-32002 – PoC d'injection de chemin de sous-module Git Motivation Pendant la résolution de la machine Compiled de la plateforme Hack The Box, j'ai rencontré un comportement curieux impliquant Git et les sous-modules. En creusant plus profondément, j'ai trouvé cet excellent article du...

CVE-2023-51385_test

Validation de CVE-2023-51385 Tout d'abord, ajoutez le contenu suivant dans /.ssh/config : host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Il existe une injection de commande dans la déclaration du fichier .gitmodules : url = ssh://echo helloworld...

DEBIAN-CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

UBUNTU-CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689

GitPython versions prior to 3.1.62 are vulnerable to a path traversal flaw when updating submodules. The root cause is the lack of validation for the path field read from an untrusted .gitmodules file during the Submodule.update() operation. While other methods like add() and move() utilize a con...

CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

Linux Distros Unpatched Vulnerability : CVE-2026-100689

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27j...