GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

CRITICAL 9.8CVE-2023-40267 · GHSA-pr76-5cm5-w9cj · PYSEC-2023-137 · Published 11/08/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
gitpython PyPI	`< 3.1.32`	`3.1.32`
gitpython gitpython_project	`< 3.1.32`	`3.1.32`

Description

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from, making it vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

NVD description

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free