https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 18:20:23 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-05185 bdu:2023-05185 https://cve.radiocsirt.org/vuln/bdu:2023-05185 https://cve.radiocsirt.org/vuln/brew-checkov-cve-2023-40590 <p><strong>Affected:</strong> Homebrew: checkov</p> <p>### Summary</p> <p>When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment (see big warning in https://docs.python.org/3/library/subprocess.html#popen-constructor). GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user&#39;s `PATH`.</p> <p>### Details</p> <p>This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren&#39;t affected by this. But probably people using GitPython usually run it from the CWD of a repo.</p> <p>The execution of the `git` command happens in</p> <p>https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/cmd.py#L277</p> <p>https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/cmd.py#L983-L996</p> <p>And there are other commands executed that should probably be aware of this problem.</p> <p>### PoC</p> <p>On a Windows system, create a `git.exe` or `git` executable in any directory, and import or run GitPython from that directory</p> <p>``` python -c &#34;import git&#34; ```</p> <p>The git executable from the current directory will be run.</p> <p>### Impact</p> <p>An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands.</p> <p>### Possible solutions - Default to an absolute path for the git program on W…</p> <p><strong>Affected:</strong> Homebrew: checkov</p> <p>### Summary</p> <p>When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment (see big warning in https://docs.python.org/3/library/subprocess.html#popen-constructor). GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user&#39;s `PATH`.</p> <p>### Details</p> <p>This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren&#39;t affected by this. But probably people using GitPython usually run it from the CWD of a repo.</p> <p>The execution of the `git` command happens in</p> <p>https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/cmd.py#L277</p> <p>https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/cmd.py#L983-L996</p> <p>And there are other commands executed that should probably be aware of this problem.</p> <p>### PoC</p> <p>On a Windows system, create a `git.exe` or `git` executable in any directory, and import or run GitPython from that directory</p> <p>``` python -c &#34;import git&#34; ```</p> <p>The git executable from the current directory will be run.</p> <p>### Impact</p> <p>An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands.</p> <p>### Possible solutions - Default to an absolute path for the git program on W…</p> https://cve.radiocsirt.org/vuln/brew-checkov-cve-2023-40590 https://cve.radiocsirt.org/vuln/euvd-2026-190882 EUVD-2026-190882 https://cve.radiocsirt.org/vuln/euvd-2026-190882 https://cve.radiocsirt.org/vuln/fkie_cve-2023-40590 <p>GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user&#39;s `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren&#39;t affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable.</p> <p>GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user&#39;s `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren&#39;t affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-40590 https://cve.radiocsirt.org/vuln/ghsa-wfm5-v35h-vwf4 <p><strong>Affected:</strong> PyPI: GitPython</p> <p>### Summary</p> <p>When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment (see big warning in https://docs.python.org/3/library/subprocess.html#popen-constructor). GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user&#39;s `PATH`.</p> <p>### Details</p> <p>This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren&#39;t affected by this. But probably people using GitPython usually run it from the CWD of a repo.</p> <p>The execution of the `git` command happens in</p> <p>https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/cmd.py#L277</p> <p>https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/cmd.py#L983-L996</p> <p>And there are other commands executed that should probably be aware of this problem.</p> <p>### PoC</p> <p>On a Windows system, create a `git.exe` or `git` executable in any directory, and import or run GitPython from that directory</p> <p>``` python -c &#34;import git&#34; ```</p> <p>The git executable from the current directory will be run.</p> <p>### Impact</p> <p>An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands.</p> <p>### Possible solutions - Default to an absolute path for the git program on W…</p> <p><strong>Affected:</strong> PyPI: GitPython</p> <p>### Summary</p> <p>When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment (see big warning in https://docs.python.org/3/library/subprocess.html#popen-constructor). GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user&#39;s `PATH`.</p> <p>### Details</p> <p>This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren&#39;t affected by this. But probably people using GitPython usually run it from the CWD of a repo.</p> <p>The execution of the `git` command happens in</p> <p>https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/cmd.py#L277</p> <p>https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/cmd.py#L983-L996</p> <p>And there are other commands executed that should probably be aware of this problem.</p> <p>### PoC</p> <p>On a Windows system, create a `git.exe` or `git` executable in any directory, and import or run GitPython from that directory</p> <p>``` python -c &#34;import git&#34; ```</p> <p>The git executable from the current directory will be run.</p> <p>### Impact</p> <p>An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands.</p> <p>### Possible solutions - Default to an absolute path for the git program on W…</p> https://cve.radiocsirt.org/vuln/ghsa-wfm5-v35h-vwf4 https://cve.radiocsirt.org/vuln/gsd-2023-40590 gsd-2023-40590 https://cve.radiocsirt.org/vuln/gsd-2023-40590 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13207-1 <p>python310-GitPython-3.1.34.1693646983.2a2ae77-1.1 on GA media</p> <p>python310-GitPython-3.1.34.1693646983.2a2ae77-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13207-1 https://cve.radiocsirt.org/vuln/pysec-2023-161 <p><strong>Affected:</strong> PyPI: gitpython</p> <p>GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user&#39;s `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren&#39;t affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable.</p> <p><strong>Affected:</strong> PyPI: gitpython</p> <p>GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user&#39;s `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren&#39;t affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable.</p> https://cve.radiocsirt.org/vuln/pysec-2023-161 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-40590 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-git, Ubuntu:Pro:16.04:LTS: python-git, Ubuntu:Pro:18.04:LTS: python-git, Ubuntu:Pro:20.04:LTS: python-git, Ubuntu:22.04:LTS: python-git</p> <p>GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user&#39;s `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren&#39;t affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-git, Ubuntu:Pro:16.04:LTS: python-git, Ubuntu:Pro:18.04:LTS: python-git, Ubuntu:Pro:20.04:LTS: python-git, Ubuntu:22.04:LTS: python-git</p> <p>GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user&#39;s `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren&#39;t affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-40590 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2428 <p>Ein Angreifer kann eine Schwachstelle in SaltStack Salt ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann eine Schwachstelle in SaltStack Salt ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2428