CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.58 are vulnerable to a config-name injection flaw that allows attackers to manipulate git-config directives by injecting special characters into option names. This can lead to arbitrary command execution during subsequent git operations, posing a significant risk to systems using this library. Organizations utilizing GitPython should prioritize patching to mitigate the potential for remote code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)