18 matches found
BIT-PYTHON-2026-12345 Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...
CVE-2026-12345
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...
CVE-2026-12345
A race condition exists in the tempfile.TemporaryDirectory cleanup process. An attacker who can modify the tree during cleanup may replace a directory with a symbolic link , causing the process to delete files or reset permissions and flags on files outside the temporary directory. This vulnerabi...
CVE-2026-12345 Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...
CVE-2026-12345: Improper Link Resolution Before File Access
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...
SUSE CVE-2026-100689
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...
CVE-2026-100689
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...
UBUNTU-CVE-2026-100689
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...
CVE-2026-100689
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...
CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...
CVE-2026-100689
GitPython versions prior to 3.1.62 are vulnerable to a path traversal flaw when updating submodules. The root cause is the lack of validation for the path field read from an untrusted .gitmodules file during the Submodule.update() operation. While other methods like add() and move() utilize a con...
EUVD-2026-87662
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...
CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...
CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...
CVE-2026-100689
GitPython before 3.1.62 does not validate the "path" field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the "name" field, and GitPython's own containment guard Submodule.torelativepath is applied...
PT-2026-99360
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.62 Description GitPython fails to validate the path field read from an untrusted .gitmodules file during submodule updates. While constraints exist for the name field and certain operations like add and move, th...
CVE-2026-100689: Improper Limitation of a Pathname to a Restricted Directory
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...
Directory Traversal
Overview compliance-trestle is a Tools to manage & autogenerate python objects representing the OSCAL layers/models Affected versions of this package are vulnerable to Directory Traversal via the --output argument in the author catalog, author prof, author ssp, create, and replicate commands, whi...