Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gitpython-developers/gitpython
main @ 5a91560
7
Fixes
9
CVEs
CRITICAL
Peak severity
50.0%
Coverage
Highlights
Injection: 2 prior fixes. Scrutinize any change in this area.
git/config.py: most-fixed (2 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Bypasses in dangerous option detection during clone operations allow arbitrary command execution when arguments are improperly parsed or structured. Multi-options are particularly vulnerable if validation occurs on unsplit lists instead of individual split arguments.
Remote Code Execution: Unsafe Git command options (e.g., using underscores like upload_pack) can bypass blocking logic in option check mechanisms, allowing attackers to trigger arbitrary code execution during remote-facing operations.
Path Traversal: Insufficient canonicalization and boundary checking when writing, deleting, or renaming Git reference paths allows attackers to modify, create, or delete arbitrary files outside of the authorized repository directory structure.