{"action":"Upgrade gitpython to 3.1.30 or later.","affected":[{"fixed":"3.1.30","introduced":"0"}],"component":"gitpython","cve_ids":["CVE-2022-24439"],"ecosystem":"PyPI","epss":0.06137,"exploited":false,"fixed_versions":["3.1.30"],"ghsa_id":"GHSA-hcpj-qp55-gfph","id":"tcs_01M5KGHA8889WFKPNHMP8JQ98Y","modified_at":"2026-06-10T17:01:18.875610166Z","published_at":"2022-12-06T05:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-42992","https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858","https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.py%23L1249","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X/","https://github.com/advisories/GHSA-hcpj-qp55-gfph"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-42992","url":"https://osv.dev/vulnerability/PYSEC-2022-42992"}],"summary":"All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone"}