https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 21:38:34 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-00628 bdu:2024-00628 https://cve.radiocsirt.org/vuln/bdu:2024-00628 https://cve.radiocsirt.org/vuln/brew-cf2tf-cve-2024-22190 <p><strong>Affected:</strong> Homebrew: cf2tf</p> <p>### Summary</p> <p>This issue exists because of an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository.</p> <p>### Details</p> <p>Although GitPython often avoids executing programs found in an untrusted search path since 3.1.33, two situations remain where this still occurs. Either can allow arbitrary code execution under some circumstances.</p> <p>#### When a shell is used</p> <p>GitPython can be told to run `git` commands through a shell rather than as direct subprocesses, by passing `shell=True` to any method that accepts it, or by both setting `Git.USE_SHELL = True` and not passing `shell=False`. Then the Windows `cmd.exe` shell process performs the path search, and GitPython does not prevent that shell from finding and running `git` in the current directory.</p> <p>When GitPython runs `git` directly rather than through a shell, the GitPython process performs the path search, and currently omits the current directory by setting `NoDefaultCurrentDirectoryInExePath` in its own environment during the `Popen` call. Although the `cmd.exe` shell will honor this environment variable when present, GitPython does not currently pass it into the shell subprocess&#39;s environment.</p> <p>Furthermore, because GitPython sets the subprocess CWD to the root of a repository&#39;s working tree…</p> <p><strong>Affected:</strong> Homebrew: cf2tf</p> <p>### Summary</p> <p>This issue exists because of an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository.</p> <p>### Details</p> <p>Although GitPython often avoids executing programs found in an untrusted search path since 3.1.33, two situations remain where this still occurs. Either can allow arbitrary code execution under some circumstances.</p> <p>#### When a shell is used</p> <p>GitPython can be told to run `git` commands through a shell rather than as direct subprocesses, by passing `shell=True` to any method that accepts it, or by both setting `Git.USE_SHELL = True` and not passing `shell=False`. Then the Windows `cmd.exe` shell process performs the path search, and GitPython does not prevent that shell from finding and running `git` in the current directory.</p> <p>When GitPython runs `git` directly rather than through a shell, the GitPython process performs the path search, and currently omits the current directory by setting `NoDefaultCurrentDirectoryInExePath` in its own environment during the `Popen` call. Although the `cmd.exe` shell will honor this environment variable when present, GitPython does not currently pass it into the shell subprocess&#39;s environment.</p> <p>Furthermore, because GitPython sets the subprocess CWD to the root of a repository&#39;s working tree…</p> https://cve.radiocsirt.org/vuln/brew-cf2tf-cve-2024-22190 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0145 certfr-2024-avi-0145 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0145 https://cve.radiocsirt.org/vuln/euvd-2026-161162 EUVD-2026-161162 https://cve.radiocsirt.org/vuln/euvd-2026-161162 https://cve.radiocsirt.org/vuln/fkie_cve-2024-22190 <p>GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.</p> <p>GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-22190 https://cve.radiocsirt.org/vuln/ghsa-2mqj-m65w-jghx <p><strong>Affected:</strong> PyPI: GitPython</p> <p>### Summary</p> <p>This issue exists because of an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository.</p> <p>### Details</p> <p>Although GitPython often avoids executing programs found in an untrusted search path since 3.1.33, two situations remain where this still occurs. Either can allow arbitrary code execution under some circumstances.</p> <p>#### When a shell is used</p> <p>GitPython can be told to run `git` commands through a shell rather than as direct subprocesses, by passing `shell=True` to any method that accepts it, or by both setting `Git.USE_SHELL = True` and not passing `shell=False`. Then the Windows `cmd.exe` shell process performs the path search, and GitPython does not prevent that shell from finding and running `git` in the current directory.</p> <p>When GitPython runs `git` directly rather than through a shell, the GitPython process performs the path search, and currently omits the current directory by setting `NoDefaultCurrentDirectoryInExePath` in its own environment during the `Popen` call. Although the `cmd.exe` shell will honor this environment variable when present, GitPython does not currently pass it into the shell subprocess&#39;s environment.</p> <p>Furthermore, because GitPython sets the subprocess CWD to the root of a repository&#39;s working tree…</p> <p><strong>Affected:</strong> PyPI: GitPython</p> <p>### Summary</p> <p>This issue exists because of an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository.</p> <p>### Details</p> <p>Although GitPython often avoids executing programs found in an untrusted search path since 3.1.33, two situations remain where this still occurs. Either can allow arbitrary code execution under some circumstances.</p> <p>#### When a shell is used</p> <p>GitPython can be told to run `git` commands through a shell rather than as direct subprocesses, by passing `shell=True` to any method that accepts it, or by both setting `Git.USE_SHELL = True` and not passing `shell=False`. Then the Windows `cmd.exe` shell process performs the path search, and GitPython does not prevent that shell from finding and running `git` in the current directory.</p> <p>When GitPython runs `git` directly rather than through a shell, the GitPython process performs the path search, and currently omits the current directory by setting `NoDefaultCurrentDirectoryInExePath` in its own environment during the `Popen` call. Although the `cmd.exe` shell will honor this environment variable when present, GitPython does not currently pass it into the shell subprocess&#39;s environment.</p> <p>Furthermore, because GitPython sets the subprocess CWD to the root of a repository&#39;s working tree…</p> https://cve.radiocsirt.org/vuln/ghsa-2mqj-m65w-jghx https://cve.radiocsirt.org/vuln/gsd-2024-22190 gsd-2024-22190 https://cve.radiocsirt.org/vuln/gsd-2024-22190 https://cve.radiocsirt.org/vuln/pysec-2024-4 <p><strong>Affected:</strong> PyPI: gitpython</p> <p>GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.</p> <p><strong>Affected:</strong> PyPI: gitpython</p> <p>GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.</p> https://cve.radiocsirt.org/vuln/pysec-2024-4 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-22190 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-git, Ubuntu:Pro:16.04:LTS: python-git, Ubuntu:Pro:18.04:LTS: python-git, Ubuntu:Pro:20.04:LTS: python-git, Ubuntu:Pro:22.04:LTS: python-git, Ubuntu:24.04:LTS: python-git, Ubuntu:25.10: python-git, Ubuntu:26.04:LTS: python-git</p> <p>GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-git, Ubuntu:Pro:16.04:LTS: python-git, Ubuntu:Pro:18.04:LTS: python-git, Ubuntu:Pro:20.04:LTS: python-git, Ubuntu:Pro:22.04:LTS: python-git, Ubuntu:24.04:LTS: python-git, Ubuntu:25.10: python-git, Ubuntu:26.04:LTS: python-git</p> <p>GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-22190