[Snyk: High] Gitpython (Due 09/30/23)

[cnlucas]

Gitpython -Untrusted Search Path

Introduced through
gitpython@3.1.32
Fixed in
gitpython@3.1.33

Exploit maturity
Proof of Concept

Detailed paths and remediation

Introduced through: project@0.0.0 › gitpython@3.1.32
Fix: Upgrade gitpython to version 3.1.33

Security information
Factors contributing to the scoring:

Snyk: [CVSS 7.8](https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-5871282) - High Severity
NVD: Not available. NVD has not yet published its analysis.

Why are the scores different? Learn how Snyk evaluates vulnerability scores
Overview

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Untrusted Search Path allowing an attacker to run any arbitrary commands through a downloaded repository with a malicious git executable.

Note: This vulnerability affects only Windows systems.

Completion Criteria
[ ] We have either upgraded and removed the vulnerability, or determined we are not affected