-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how powerline-gitstatus invokes git commands. The patch explicitly adds '-c core.fsmonitor=' to the git command line in the get_base_command function to neutralize malicious repository configurations. The pre-patch version of this function (as shown in the diff) lacked this mitigation, making it the clear injection point. The function's responsibility for building the git command and the direct fix applied to it confirm its role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| powerline-gitstatus | pip | < 1.3.2 | 1.3.2 |