CVE-2022-24439

Aliases:GHSA-hcpj-qp55-gfphPYSEC-2022-42992
Advisory lineage Upstream: 0 Downstream: 9
Modified
Published: 12 Dec 2022, 01:49
Last modified:03 Nov 2025, 21:46

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
68.86% CRITICAL
69% probability -1.29%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

12 Dec 2022, 01:49
Published
Vulnerability first disclosed
03 Nov 2025, 21:46
Last Modified
Vulnerability information updated

Description

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

CVSS Metrics

  • v4.0•CRITICAL•Score: 9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 68.86%• Percentile: 99%

Techniques & Countermeasures

  • CWE-20•Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected Systems

  • debian•debian_linux

    10.0

  • fedoraproject•fedora

    36 | 37 | 38

  • gitpython_project•gitpython

    < 3.1.30

  • PyPI•gitpython

    < 3.1.30

References (26)