CVE-2024-22190: high-severity vulnerability in gitpython-developers GitPython
Untrusted search path under some conditions on Windows allows arbitrary code execution
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.8epss 0.3%
GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
gitpython-developers · GitPythonRelated CVEs — gitpython-developers GitPython
In the same product, most dangerous first.
CVE-2026-67325HIGHGitPython before 3.1.51 Command Injection via option prefix abbreviationEPSS 2.2%CVE-2026-67323HIGHGitPython before 3.1.51 Command Injection via unguarded Git optionsEPSS 1.3%CVE-2023-41040MEDIUMGitPython blind local file inclusionEPSS 1.1%CVE-2026-73623HIGHGitPython before 3.1.54 Remote Code Execution via --templateEPSS 1.0%CVE-2026-42215HIGHGitPython: Command injection via Git options bypassEPSS 0.7%CVE-2026-76218HIGHGitPython before 3.1.58 Remote Code Execution via Repo.initEPSS 0.7%