CVE-2022-24439

HIGH

gitpython - RCE

Title source: llm

Description

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Exploits (2)

nomisec STUB 1 stars
by Makkkiiii · poc
https://github.com/Makkkiiii/GitPython-Exploit-CVE-2022-24439
nomisec WORKING POC
by muhammadhendro · poc
https://github.com/muhammadhendro/CVE-2022-24439

References (9)

Scores

CVSS v3 8.1
EPSS 0.6886
EPSS Percentile 98.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (6)
debian/debian_linux 10.0
fedoraproject/fedora 36
fedoraproject/fedora 37
fedoraproject/fedora 38
gitpython_project/gitpython < 3.1.30
pypi/GitPython 0 - 3.1.30PyPI
Published Dec 06, 2022
Tracked Since Feb 18, 2026