GHSA-fjr4-x663-mwxc: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
Diffable.diff() forwards **kwargs straight into diff/diff_tree with no check_unsafe_options guard. Diffable is mixed into Commit, Tree, IndexFile, and Submodule, giving a broad surface. git diff --output=<path> writes real patch content to an attacker-chosen path, enabling arbitrary file overwrite.
References
- github.com/advisories/GHSA-fjr4-x663-mwxc
- github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6
- github.com/gitpython-developers/GitPython/pull/2180
- github.com/gitpython-developers/GitPython/releases/tag/3.1.54
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc
Code Behaviors & Features
Detect and mitigate GHSA-fjr4-x663-mwxc with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →