Update fastapi to 0.138.0 #584

coderabbitai · 2026-06-20T03:32:02Z

CVE-2022-24439

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Description: Identify gitpython in the dependency tree # Expected: Locate gitpython and verify if it's needed echo "=== Checking for gitpython in dependency tree ===" grep -r "gitpython\|GitPython" . --include="*.txt" --include="*.toml" --include="*.in" 2>/dev/null || echo "Not found in direct dependencies" echo "=== Resolving dependency tree (requires pip) ===" pip install pip-audit 2>/dev/null && pip-audit --desc 2>&1 | grep -i gitpython || echo "Dependency audit skipped"

Repository: salimfadhley/dockerized_python_playground

Length of output: 4356

🏁 Script executed:

# Check the exact content of src/requirements.txt cat src/requirements.txt

Repository: salimfadhley/dockerized_python_playground

Length of output: 127

🏁 Script executed:

# Search for any gitpython imports or usage in the codebase rg "import.*[Gg]it|from.*[Gg]it" --type py

Repository: salimfadhley/dockerized_python_playground

Length of output: 67

🌐 Web query:

gitpython 3.1.9 CVE RCE vulnerabilities critical

💡 Result:

GitPython version 3.1.9 is significantly outdated and is affected by multiple critical and high-severity vulnerabilities, including several Remote Code Execution (RCE) flaws [1][2]. Users should upgrade to the latest version immediately [2][3]. Key security findings for GitPython 3.1.9 include: 1. RCE via Insecure Git Options and Arguments: Version 3.1.9 lacks protections against various forms of command injection. Specifically, it is vulnerable to CVE-2022-24439, which allows RCE via maliciously crafted remote URLs passed to clone commands [4][5]. Additionally, newer vulnerabilities discovered in 2026 (such as CVE-2026-42215 and CVE-2026-42284) highlight that improper validation of Git options and configuration arguments in older versions can lead to arbitrary command execution [6][7][8]. 2. Other Vulnerabilities: GitPython has had numerous security patches since version 3.1.9 to address issues like untrusted search path exploitation on Windows (CVE-2024-22190) and improper validation of reference paths or configuration values [9][3][10]. 3. Recommended Action: Because version 3.1.9 predates many critical security fixes, it is considered insecure [1][2][11]. You must update to the latest available version of GitPython to mitigate these RCE risks and other security exposures [3]. For a complete list of CVEs affecting specific versions, consult the official GitPython GitHub security advisories or the National Vulnerability Database (NVD) [6][4][9][8][10].

Citations:

1: https://pypi.org/project/GitPython/3.1.9/

2: https://app.opencve.io/cve/?vendor=gitpython_project

3: https://lists.ubuntu.com/archives/ubuntu-security-announce/2026-May/010617.html

4: https://nvd.nist.gov/vuln/detail/cve-2022-24439

5: https://osv.dev/vulnerability/CVE-2022-24439

6: GHSA-rpm5-65cw-6hj4

7: GHSA-x2qx-6953-8485

8: https://nvd.nist.gov/vuln/detail/cve-2026-42284

9: https://nvd.nist.gov/vuln/detail/CVE-2024-22190

10: https://nvd.nist.gov/vuln/detail/CVE-2026-44244

11: GHSA-2mqj-m65w-jghx

Remove unused gitpython dependency with critical RCE vulnerabilities.

GitPython is listed as a direct dependency in src/requirements.txt but is not imported or used anywhere in the codebase. GitPython 3.1.9 is affected by multiple critical RCE vulnerabilities including CVE-2022-24439 (RCE via malicious remote URLs), CVE-2024-22190 (untrusted search path), and others. Since this dependency serves no purpose, remove it from requirements.txt entirely rather than attempting to update it.

🧰 Tools

🪛 OSV Scanner (2.3.8)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2022-42992)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-137)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-165)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2024-4)

[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution

(GHSA-2mqj-m65w-jghx)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

(GHSA-7545-fcxq-7j24)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion

(GHSA-cwvm-v4w8-q58c)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation

(GHSA-hcpj-qp55-gfph)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

(GHSA-mv93-w799-cj2w)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

(GHSA-pr76-5cm5-w9cj)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

(GHSA-v87r-6q3f-2j67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution

(GHSA-wfm5-v35h-vwf4)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation

(GHSA-x2qx-6953-8485)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/requirements.txt` at line 1, Remove the GitPython dependency from src/requirements.txt entirely. Since GitPython is not imported or used anywhere in the codebase and contains multiple critical RCE vulnerabilities (CVE-2022-24439, CVE-2024-22190, etc.), locate and delete the GitPython version line from the requirements.txt file to eliminate the unused and vulnerable dependency.

Source: Linters/SAST tools

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Description: Check Python version constraints in project configuration files # Expected: All configs should specify Python >=3.10 echo "=== Checking Python version constraints ===" echo "pyproject.toml:" grep -E "(python_requires|requires-python)" pyproject.toml 2>/dev/null || echo " Not found" echo "setup.py:" grep -E "python_requires" setup.py 2>/dev/null || echo " Not found" echo ".python-version:" cat .python-version 2>/dev/null || echo " Not found" echo "Dockerfile Python FROM version:" grep -E "FROM python:" Dockerfile* 2>/dev/null || echo " Not found" echo ".tool-versions:" cat .tool-versions 2>/dev/null | grep python || echo " Not found"

Repository: salimfadhley/dockerized_python_playground

Length of output: 280

🏁 Script executed:

#!/bin/bash # List repository files to understand structure echo "=== Repository structure ===" git ls-files | head -30 echo -e "\n=== Check if requirements.txt exists ===" find . -name "requirements.txt" -type f 2>/dev/null echo -e "\n=== List src directory ===" ls -la src/ 2>/dev/null || echo "src/ does not exist" echo -e "\n=== Current directory content ===" ls -la | head -20

Repository: salimfadhley/dockerized_python_playground

Length of output: 2099

🏁 Script executed:

#!/bin/bash # Read the actual requirements.txt file if it exists echo "=== Contents of src/requirements.txt ===" cat src/requirements.txt 2>/dev/null || echo "File not found" echo -e "\n=== Check for requirements files in repo ===" find . -name "*requirements*.txt" -o -name "pyproject.toml" -o -name "setup.py" 2>/dev/null

Repository: salimfadhley/dockerized_python_playground

Length of output: 279

🏁 Script executed:

#!/bin/bash # Read setup.py to check Python version requirement echo "=== src/setup.py content ===" cat src/setup.py echo -e "\n=== Dockerfile content ===" cat Dockerfile echo -e "\n=== requirements_dev.txt content ===" cat src/requirements_dev.txt

Repository: salimfadhley/dockerized_python_playground

Length of output: 1474

🏁 Script executed:

#!/bin/bash # Check base image Python version echo "=== Checking base image salimfadhley/testpython ===" cat Dockerfile # Let's also check git history to understand this change echo -e "\n=== Recent git log for requirements.txt ===" git log --oneline src/requirements.txt 2>/dev/null | head -10 echo -e "\n=== Git diff for requirements.txt ===" git diff HEAD~1 src/requirements.txt 2>/dev/null || git show HEAD:src/requirements.txt 2>/dev/null

Repository: salimfadhley/dockerized_python_playground

Length of output: 489

🌐 Web query:

FastAPI 0.138.0 Python version requirement

💡 Result:

As of June 20, 2026, FastAPI version 0.138.0 requires Python 3.10 or newer [1]. This requirement is explicitly stated in the package metadata on PyPI [1]. FastAPI dropped support for Python 3.9 in version 0.129.0, establishing Python 3.10 as the minimum required version for subsequent releases [2][3].

Citations:

1: https://pypi.org/project/fastapi/

2: https://deepwiki.com/fastapi/fastapi/8.1-version-history-and-release-notes

3: https://deepwiki.com/fastapi/fastapi/8.2-breaking-changes-and-migration

🌐 Web query:

uvicorn 0.4.6 security vulnerabilities CVE

💡 Result:

The version of Uvicorn 0.4.6 is affected by multiple security vulnerabilities, as it precedes the fixed version 0.11.7 [1][2][3]. The identified vulnerabilities for this version are: 1. CVE-2020-7694 (Log Injection): The request logger is vulnerable to ANSI escape sequence injection [2][4]. Attackers can use crafted URLs to pollute logs or potentially interact with the terminal emulator displaying those logs [2][5]. 2. CVE-2020-7695 (HTTP Response Splitting): Uvicorn is vulnerable to HTTP response splitting because CRLF sequences are not properly escaped in HTTP header values [2][6][7]. This allows attackers to inject arbitrary headers or an arbitrary response body into HTTP responses [2][6]. Both vulnerabilities were patched in Uvicorn version 0.11.7 [1][3]. It is strongly recommended to update to a modern, stable version of Uvicorn to mitigate these and subsequent security risks [3].

Citations:

1: https://pypi.org/project/uvicorn/0.4.6/

2: https://www.versioneye.com/Python/uvicorn/0.4.6

3: https://www.sherlockforensics.com/security/pypi/uvicorn.html

4: https://app.opencve.io/cve/?product=uvicorn&vendor=encode

5: https://nvd.nist.gov/vuln/detail/CVE-2020-7694

6: https://nvd.nist.gov/vuln/detail/cve-2020-7695

7: https://osv.dev/vulnerability/GHSA-f97h-2pfx-f59f

Add Python 3.10+ requirement to setup.py; update uvicorn to fix security vulnerabilities.

FastAPI 0.138.0 requires Python 3.10 or newer, but src/setup.py does not specify a python_requires constraint. This will cause silent failures on Python 3.9 or earlier. Add python_requires=">=3.10" to setup.py.

Additionally, uvicorn 0.4.6 contains two documented security vulnerabilities: CVE-2020-7694 (log injection via ANSI escape sequences) and CVE-2020-7695 (HTTP response splitting via unescaped CRLF in headers). Update to uvicorn 0.11.7 or later.

🧰 Tools

🪛 OSV Scanner (2.3.8)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2022-42992)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-137)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-165)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2024-4)

[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution

(GHSA-2mqj-m65w-jghx)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

(GHSA-7545-fcxq-7j24)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion

(GHSA-cwvm-v4w8-q58c)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation

(GHSA-hcpj-qp55-gfph)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

(GHSA-mv93-w799-cj2w)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

(GHSA-pr76-5cm5-w9cj)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

(GHSA-v87r-6q3f-2j67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution

(GHSA-wfm5-v35h-vwf4)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation

(GHSA-x2qx-6953-8485)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/requirements.txt` at line 1, The FastAPI version in requirements.txt now requires Python 3.10 or newer, but setup.py does not declare this minimum Python version constraint. Add `python_requires=">=3.10"` parameter to the setup() function call in setup.py to prevent installation failures on earlier Python versions. Additionally, the uvicorn package version in requirements.txt contains documented security vulnerabilities in versions before 0.11.7. Update the uvicorn dependency to version 0.11.7 or later to address CVE-2020-7694 (log injection via ANSI escape sequences) and CVE-2020-7695 (HTTP response splitting via unescaped CRLF in headers).

coderabbitai · 2026-06-20T03:32:03Z

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Critical security issue: Upgrade uvicorn from 0.4.6 to latest (0.48.0).

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers. Version 0.4.6 (released ~2020) is extremely outdated and vulnerable.

Update uvicorn==0.4.6 to at least uvicorn==0.48.0 (latest as of June 2026).

🔒 Proposed fix

-uvicorn==0.4.6 +uvicorn==0.48.0

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

uvicorn==0.4.6

uvicorn==0.48.0

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/requirements.txt` at line 3, The uvicorn package specified in the requirements.txt file is pinned to version 0.4.6, which contains a critical HTTP response splitting vulnerability. Update the uvicorn dependency from version 0.4.6 to at least version 0.48.0 (the latest available version) in the requirements.txt file. This upgrade will patch the CRLF injection vulnerability that allows attackers to manipulate HTTP headers and response bodies.

Navigation Menu

Update fastapi to 0.138.0 #584

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Jun 20, 2026

Uh oh!

coderabbitai Bot Jun 20, 2026

Uh oh!

Update fastapi to 0.138.0 #584

Uh oh!

Update fastapi to 0.138.0 #584

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Jun 20, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 20, 2026

Choose a reason for hiding this comment

Uh oh!