Remote code execution (RCE) in GitPython
Priority MEDIUM 51CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.
Summary
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
Why it matters now
EPSS 0.06137 93rd percentileScored 2026-11-07
Fix Partial GitPython (PyPI): 3.1.30Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | GitPython | all versions | — | No fix listed | CNA |
| — | GitPython (PyPI) | before 3.1.30 | 3.1.30 | Patch available | GHSA-hcpj-qp55-gfph |
- GitPython Vendor— Affected all versions Fixed in — No fix listed CNA
- GitPython (PyPI) Vendor— Affected before 3.1.30 Fixed in 3.1.30 Patch available GHSA-hcpj-qp55-gfph
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* | before 3.1.30 | Vulnerable | gitpython-developers |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* Versions before 3.1.30 Vulnerable ·gitpython-developers
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-hcpj-qp55-gfph GitPython (PyPI) Fixed in 3.1.30 Advisory →
Red Hat 1 advisory
- RHSA-2023:5931 Released 2023-10-19 · Red Hat rating ImportantSatellite 6.13.5 Async Security Update
- Red Hat Satellite 6.13 for RHEL 8 foreman-3.5.1.23-1.el8sat, foreman-cli-3.5.1.23-1.el8sat, foreman-debug-3.5.1.23-1.el8sat +17
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet |
| Red Hat OpenStack Platform 16.1 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat OpenStack Platform 17.0 | Affected | No fix yet |
| Red Hat Satellite 6.13 for RHEL 8 | Fixed | RHSA-2023:5931 |
Not affected: 1 product
- Red Hat Satellite 6.13 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24439
- 2026-10-03 Alias added: GHSA-hcpj-qp55-gfph
References
Advisory 7
Other 16
- https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.py%23L1249
- https://github.com/gitpython-developers/GitPython/issues/1515
- https://github.com/gitpython-developers/GitPython/commit/2625ed9fc074091c531c27ffcba7902771130261
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH
- https://lists.debian.org/debian-lts-announce/2024/10/msg00030.html
- https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2022-42992.yaml
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.30
- https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.py#L1249
- https://github.com/gitpython-developers/GitPython
Sources
- CVE-2022-24439 · CVE Program
- CVE-2022-24439 · NVD
- FIRST EPSS
- GHSA-hcpj-qp55-gfph · GitHub Advisory Database · CC BY 4.0
- CVE-2022-24439 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences