CVE-2022-24439: Debian Linux

Critical severity, CVSS 9.8. EPSS: 5.7% chance of exploitation in the next 30 days.

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 36 only; version 37 only; version 38 only
• Gitpython Project Gitpython: before 3.1.30 (fixed in 3.1.30)

Published 2022-12-06. Last modified 2026-06-17.