GHSA-6p8h-3wgx-97gf: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
GitPython’s unsafe_git_clone_options denylist omits --template. git clone --template=<dir> copies <dir>/hooks/ into the new repository and runs them (post-checkout fires during clone), so a caller who can influence clone options can achieve arbitrary command execution in the default allow_unsafe_options=False configuration.
References
- github.com/advisories/GHSA-6p8h-3wgx-97gf
- github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97
- github.com/gitpython-developers/GitPython/pull/2180
- github.com/gitpython-developers/GitPython/releases/tag/3.1.54
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf
Code Behaviors & Features
Detect and mitigate GHSA-6p8h-3wgx-97gf with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →