Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

All versions of package gitpython is vulnerable to Remote Code Execution RCE due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git...

Remote Code Execution (RCE)

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Remote Code Execution RCE due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting...

Inefficient Regular Expression Complexity in gitpython-developers/gitpython

Description In the latest version of GitPython cd29f07b I discovered regular expression that is vulnerable to ReDoS Regular Expression Denial of Service Proof of Concept PoC based on code in git/remote.py Python import logging import re logging.basicConfigformat='%asctimes - %levelnames:...

Leakage Of Environment Variables

gitPython is vulnerable to the leakage of environment variables. The leakage happens through error messages because it does not use the unsafe variable in the expandpath method. The unsafe variable should be set to False to prevent this. However, the variable is set to True by default...