Threats affecting pkg:bitnami/couchdb

GitPython's _clone() method improperly expands environment variables in the separate_git_dir parameter derived from attacker-controlled .gitmodules submodule names. This leads to leakage of environment variable values as directory names on disk and in debug logs when cloning and updating submodules from a malicious repository. The flaw arises because Git.polish_url() is called without disabling variable expansion on untrusted input. This vulnerability affects GitPython versions starting from 2.12.0 and has a CVSS score of 6.5.

GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method where an attacker-controlled branch name can be used to perform an arbitrary file read. This occurs because the branch name is passed as a positional argument to git checkout without proper sanitization or argument separation, allowing injection of git options like --pathspec-from-file. The flaw was incompletely fixed in prior advisories, leaving Head.checkout vulnerable. An attacker who can cause the application to clone a repository they control can exploit this to read any file accessible by the application process, with no authentication or privileges required.

GitPython's Submodule.move() API does not properly handle symbolic links in intermediate path components, allowing an attacker-controlled repository to cause the submodule move operation to escape the intended worktree directory. This can result in moving submodule content outside the parent repository, corrupting the repository's index and configuration state. The vulnerability requires an attacker to control a Git repository with a symlink named 'vendor' pointing outside the worktree and the application to call Submodule.move() with a path under that symlink. No code execution or confidentiality impact has been demonstrated.

GitPython's Remote.pull() method improperly handles its positional refspec argument, allowing an attacker to inject a crafted --upload-pack option that bypasses the unsafe-option guard. This leads to arbitrary command execution with the privileges of the calling process when using local-path or SSH transports. The vulnerability arises because the unsafe-option check only inspects keyword arguments, not positional ones, and git pull forwards the refspec to an internal git fetch without a separator, enabling the injected option to be executed.

GitPython versions 5.0.0 and later contain vulnerabilities in three wrapper methods that omit critical checks for unsafe protocols and options. The ls_remote method fails to check URLs for unsafe protocols, allowing remote code execution (RCE) if the victim's git transport policy permits the 'ext' protocol. The merge_base and IndexFile.move methods forward caller-controlled arguments without proper option checks, creating latent injection surfaces. These issues were verified on the main branch as of September 2026 and remain unpatched in the latest release. The severity is anchored on the ls_remote RCE potential, rated high with a CVSS score of 7.5.

Tartufo's GitPython integration contains a regex vulnerability in the parse_actor_and_date() function, causing quadratic backtracking on malformed author/committer/tagger identity lines missing or having malformed epoch or timezone data. This leads to significant CPU exhaustion when processing crafted commit or tag objects. The issue persists in version 3.1.62 despite partial fixes in 3.1.60. Accessing affected commit or tag fields with maliciously crafted identity lines can cause processing delays of several seconds per access.

Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)