Every CVE Search/ Get API key

CVE-2022-24439

Remote Code Execution (RCE)

8.1 HighPublic exploitFix available

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

6.14%Up 4.2 points since Dec 6, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.1

Remote Code Execution (RCE)

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Record
CVE-2022-24439
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2022-0114 8.1

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Record
EUVD-2022-0114
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-hcpj-qp55-gfph 9.2

GitPython vulnerable to Remote Code Execution due to improper user input validation

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Record
GHSA-hcpj-qp55-gfph
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20, CWE-94
Updated
2026-11-02
NVD 8.1

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Record
CVE-2022-24439
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 8.1

Remote Code Execution (RCE)

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Record
CVE-2022-24439
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2022-24439 9.8

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Record
DEBIAN-CVE-2022-24439
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
Show 10 moreShow less
OSVGHSA-hcpj-qp55-gfph 9.2

GitPython vulnerable to Remote Code Execution due to improper user input validation

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Record
GHSA-hcpj-qp55-gfph
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20, CWE-94
Updated
2026-11-02
OSVOESA-2023-1529 9.8

python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing.

Security Fix(es):

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.(CVE-2022-24439)

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.(CVE-2023-40267)

Record
OESA-2023-1529
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:5931 9.8

Red Hat Security Advisory: Satellite 6.13.5 Async Security Update

Record
RHSA-2023:5931
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-24439 8.1

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Record
UBUNTU-CVE-2022-24439
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2023-0001 No score

Updated python-gitpython packages fix security vulnerability

Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. This is only relevant when enabling the ext transport protocol (CVE-2022-24439)

Record
MGASA-2023-0001
Updated
2026-11-02
OSVopenSUSE-SU-2024:12596-1 No score

python310-GitPython-3.1.30.1672298042.141cd65-1.1 on GA media

These are all security issues fixed in the python310-GitPython-3.1.30.1672298042.141cd65-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12596-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13510-1 No score

python3-bandit-1.7.6-1.1 on GA media

These are all security issues fixed in the python3-bandit-1.7.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13510-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14858-1 No score

python311-GitPython-3.1.44-1.1 on GA media

These are all security issues fixed in the python311-GitPython-3.1.44-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14858-1
Updated
2026-11-02
OSVPYSEC-2022-42992 No score

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Record
PYSEC-2022-42992
Updated
2026-11-02
OSVUSN-5968-1 No score

python-git vulnerability

It was discovered that GitPython did not properly sanitize user inputs for remote URLs in the clone command. By injecting a maliciously crafted remote URL, an attacker could possibly use this issue to execute arbitrary commands on the host.

Record
USN-5968-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gitpython
PyPI
 through 3.1.29
3.1.30
python-git
Debian:12
 before 3.1.30-1
3.1.30-1
python-git
Debian:13
 before 3.1.30-1
3.1.30-1
python-git
Debian:14
 before 3.1.30-1
3.1.30-1
python-git
Debian:10
From an advisory covering 2 CVEs
 before 2.1.11-1+deb10u1, plus listed versions
2.1.11-1
2.1.11-1+deb10u1
python-git
Debian:11
From an advisory covering 3 CVEs
 before 3.1.14-1+deb11u1, plus listed versions
3.1.14-1
3.1.14-1+deb11u1
gitpython
PyPI
 before 3.1.30, plus listed versions
0.1.70.2.0-beta10.3.0-beta10.3.0-beta20.3.1-beta2
Show 45 moreShow less
0.3.20.3.2.10.3.2.RC10.3.30.3.40.3.50.3.60.3.71.0.01.0.11.0.22.0.02.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.0.9.dev02.0.9.dev12.1.02.1.12.1.102.1.112.1.122.1.132.1.142.1.152.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.93.0.03.0.13.0.23.0.33.0.43.0.5
3.1.30
python-gitpython
Mageia:8
 before 3.1.30-1.mga8
3.1.30-1.mga8
python-GitPython
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 3.1.32-1.oe1
3.1.32-1.oe1
python-GitPython
openEuler:20.03-LTS-SP3
From an advisory covering 2 CVEs
 before 3.1.32-1.oe1
3.1.32-1.oe1
Show 39 moreShow less
Affected packages
PackageAffectedFixed
python-GitPython
openEuler:22.03-LTS
From an advisory covering 2 CVEs
 before 3.1.32-1.oe2203sp2
3.1.32-1.oe2203sp2
python-GitPython
openEuler:22.03-LTS-SP1
From an advisory covering 2 CVEs
 before 3.1.32-1.oe2203sp1
3.1.32-1.oe2203sp1
python-GitPython
openEuler:22.03-LTS-SP2
From an advisory covering 2 CVEs
 before 3.1.32-1.oe2203sp2
3.1.32-1.oe2203sp2
puppet-agent
Red Hat:satellite_capsule:6.13::el8
From an advisory covering 13 CVEs
 before 0:7.26.0-3.el8sat
0:7.26.0-3.el8sat
puppet-agent
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:7.26.0-3.el8sat
0:7.26.0-3.el8sat
foreman
Red Hat:satellite_capsule:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-debug
Red Hat:satellite_capsule:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman
Red Hat:satellite_utils:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-cli
Red Hat:satellite_utils:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-cli
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-debug
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-dynflow-sidekiq
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-ec2
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-journald
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-libvirt
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-openstack
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-ovirt
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-postgresql
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-service
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-telemetry
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
foreman-vmware
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.5.1.23-1.el8sat
0:3.5.1.23-1.el8sat
python-gitpython
Red Hat:satellite_capsule:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.1.32-1.el8pc
0:3.1.32-1.el8pc
python39-gitpython
Red Hat:satellite_capsule:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.1.32-1.el8pc
0:3.1.32-1.el8pc
python-gitpython
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.1.32-1.el8pc
0:3.1.32-1.el8pc
python39-gitpython
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.1.32-1.el8pc
0:3.1.32-1.el8pc
rubygem-git
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:1.18.0-1.el8sat
0:1.18.0-1.el8sat
python-django
Red Hat:satellite_capsule:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.2.21-1.el8pc
0:3.2.21-1.el8pc
python39-django
Red Hat:satellite_capsule:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.2.21-1.el8pc
0:3.2.21-1.el8pc
python-django
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.2.21-1.el8pc
0:3.2.21-1.el8pc
python39-django
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:3.2.21-1.el8pc
0:3.2.21-1.el8pc
yggdrasil-worker-forwarder
Red Hat:satellite:6.13::el8
From an advisory covering 13 CVEs
 before 0:0.0.3-1.el8sat
0:0.0.3-1.el8sat
python-git
Ubuntu:Pro:14.04:LTS
 before 0.3.2~RC1-3ubuntu0.1~esm1, plus listed versions
0.3.2~RC1-20.3.2~RC1-3
0.3.2~RC1-3ubuntu0.1~esm1
python-git
Ubuntu:Pro:16.04:LTS
 before 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1, plus listed versions
1.0.1+git137-gc8b8379-11.0.1+git137-gc8b8379-21.0.1+git137-gc8b8379-2.1
1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1
python-git
Ubuntu:Pro:18.04:LTS
 before 2.1.8-1ubuntu0.1~esm1, plus listed versions
2.1.5-12.1.6-12.1.7-12.1.8-1
2.1.8-1ubuntu0.1~esm1
python-git
Ubuntu:Pro:20.04:LTS
 before 3.0.7-1ubuntu0.1~esm1, plus listed versions
2.1.11-13.0.4-13.0.5-13.0.7-1
3.0.7-1ubuntu0.1~esm1
python-git
Ubuntu:Pro:22.04:LTS
 before 3.1.24-1ubuntu0.1~esm1, plus listed versions
3.1.14-13.1.23-13.1.24-1
3.1.24-1ubuntu0.1~esm1
python3-bandit
openSUSE:Tumbleweed
 before 1.7.6-1.1
1.7.6-1.1
python-GitPython
openSUSE:Tumbleweed
 before 3.1.44-1.1
3.1.44-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubmuhammadhendro/CVE-2022-244392024-10-16
PoC in GitHubMakkkiiii/GitPython-Exploit-CVE-2022-244392025-07-12

History

History
RecordedChangedSources
affected, factsOSV
exploitsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-24439 is a high vulnerability (CVSS 8.1) in Gitpython-developers Gitpython, published December 6, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.14%, the 93rd percentile. Fixed in gitpython 3.1.30.

References

Show 107 moreShow less
This page doesn't list everything

Left out here: 33 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open