CVE-2024-22190

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
gitpython-developers	GitPython	< 3.1.41

References

https://github.com/gitpython-developers/GitPython/commit/ef3192cc414f2fd9978908454f6fd95243784c7fPatch
https://github.com/gitpython-developers/GitPython/pull/1792Patch, Vendor Advisory
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghxVendor Advisory
https://github.com/gitpython-developers/GitPython/commit/ef3192cc414f2fd9978908454f6fd95243784c7fPatch
https://github.com/gitpython-developers/GitPython/pull/1792Patch, Vendor Advisory
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghxVendor Advisory

Timeline

Published: Jan 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-221915.4Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_val CVE-2024-221926.5Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a CVE-2024-221934.3The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation CVE-2024-221942.8cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic CVE-2024-221956.1Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible t CVE-2024-221966.5Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. This is CVE-2024-221978.8Nginx-ui is online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home CVE-2024-221988.8Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration set CVE-2024-221996.1This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulner CVE-2024-22203.5The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2024-222005.3vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, CVE-2024-222017.5Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it t