GHSA-fjr4-x663-mwxc: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
Diffable.diff() forwards **kwargs straight into diff/diff_tree with no check_unsafe_options guard. Diffable is mixed into Commit, Tree, IndexFile, and Submodule, giving a broad surface. git diff --output=<path> writes real patch content to an attacker-chosen path, enabling arbitrary file overwrite.
References
- github.com/advisories/GHSA-fjr4-x663-mwxc
- github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6
- github.com/gitpython-developers/GitPython/pull/2180
- github.com/gitpython-developers/GitPython/releases/tag/3.1.54
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc
Code Behaviors & Features
Detect and mitigate GHSA-fjr4-x663-mwxc with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →