GHSA-59cr-6r3x-644w: GitPython submodule update path traversal can write outside the repository
Affected: GitPython 3.1.61 (latest release) and main — git/objects/submodule/base.py. git diff 3.1.61 origin/main -- git/objects/submodule/ is empty, so both are identical here.
References
- github.com/advisories/GHSA-59cr-6r3x-644w
- github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093
- github.com/gitpython-developers/GitPython/pull/2225
- github.com/gitpython-developers/GitPython/releases/tag/3.1.62
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-59cr-6r3x-644w
Code Behaviors & Features
Detect and mitigate GHSA-59cr-6r3x-644w with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →