Untrusted search path under some conditions on Windows allows arbitrary code execution

CVE-2024-22190

What is CVE-2024-22190?

GitPython, a popular Python library used for interacting with Git repositories, contains an issue related to an insecure search path on Windows systems. This vulnerability arises when GitPython relies on the shell to execute git commands or when it triggers bash.exe to interpret Git hooks. In both instances, there exists a risk that a maliciously crafted git.exe or bash.exe could be executed from an untrusted repository. This issue stems from an incomplete fix for a prior vulnerability. The vulnerability has been addressed and patched in GitPython version 3.1.41, emphasizing the importance of maintaining updated software to mitigate security risks.

References