{"action":"Upgrade gitpython to 3.1.30 or later.","affected":[{"fixed":"3.1.30","introduced":"0"}],"component":"gitpython","cve_ids":["CVE-2022-24439"],"ecosystem":"PyPI","epss":0.06137,"exploited":false,"fixed_versions":["3.1.30"],"ghsa_id":"GHSA-hcpj-qp55-gfph","id":"tcs_01M5KFKERF0BPR008B0TJJC1MY","modified_at":"2025-11-04T16:49:34.739763Z","published_at":"2022-12-06T06:30:17Z","references":["https://osv.dev/vulnerability/GHSA-hcpj-qp55-gfph","https://nvd.nist.gov/vuln/detail/CVE-2022-24439","https://github.com/gitpython-developers/GitPython/issues/1515","https://github.com/gitpython-developers/GitPython/commit/2625ed9fc074091c531c27ffcba7902771130261","https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858","https://security.gentoo.org/glsa/202311-01","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH","https://lists.debian.org/debian-lts-announce/2024/10/msg00030.html","https://lists.debian.org/debian-lts-announce/2023/07/msg00024.html","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2022-42992.yaml","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.30","https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.py%23L1249","https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.py#L1249","https://github.com/gitpython-developers/GitPython"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-hcpj-qp55-gfph","url":"https://osv.dev/vulnerability/GHSA-hcpj-qp55-gfph"}],"summary":"GitPython vulnerable to Remote Code Execution due to improper user input validation"}