Description
PyGIT.py in the Trac Git plugin (trac-git) before 0.0.20080710-3+lenny1 and before 0.0.20090320-1 on Debian GNU/Linux, when enabled in Trac, allows remote attackers to execute arbitrary commands via shell metacharacters in a crafted HTTP query that is used to generate a certain git command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | trac-git | 0.0.20080710-3+lenny1 | DSA-1990-2, DSA-1990-1 |
Advisories 2
- DSA-1990-2 trac-git - regression fix Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1990-1 trac-git - code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567039
- 38325 third-party-advisory
- 38076 vdb-entry
- DSA-1990 vendor-advisory
- tracgit-command-execution(56105) vdb-entry
- 62147 vdb-entry