Update fastapi to 0.140.8 #609

coderabbitai · 2026-07-28T11:44:33Z

CVE-2026-42215

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash rg -n --hidden -g '!.git' \ 'requires-python|python_requires|python-version|FROM python:' .

Repository: salimfadhley/dockerized_python_playground

Length of output: 179

🌐 Web query:

FastAPI 0.140.8 Python version requires Python >=3.10 PyPI

💡 Result:

Yes, FastAPI version 0.140.8 requires Python >=3.10. This requirement is specified in the package metadata and pyproject.toml configuration [1][2][3].

Citations:

1: https://pypi.org/project/fastapi/

2: https://github.com/fastapi/fastapi/blob/0.139.2/pyproject.toml

3: https://github.com/fastapi/fastapi/blob/master/pyproject.toml

🏁 Script executed:

#!/bin/bash set -e printf 'Tracked files / config candidates:\n' git ls-files | rg -n '(^|/)(\.github/[^/]*/[^/]*\.ya?ml$|Dockerfile|docker-compose.*\.ya?ml$|\.python-version$|pyproject\.toml$|setup\.py$|requirements.*\.txt$|tox\.ini$|Pipfile$|poetry\.lock$)' || true printf '\nFastAPI / package/config snippets:\n' if [ -f src/requirements.txt ]; then cat -n src/requirements.txt; fi rg -n --hidden -g '!.git' 'fastapi|python_requires|requires-python|python-version|FROM python|python:' . || true

Repository: salimfadhley/dockerized_python_playground

Length of output: 516

🏁 Script executed:

#!/bin/bash set -e printf 'Dockerfile:\n' cat -n Dockerfile printf '\ndocker-compose.yaml:\n' cat -n docker-compose.yaml printf '\nsrc/setup.py:\n' cat -n src/setup.py printf '\n.travis.yml:\n' cat -n .travis.yml printf '\npyproject/setup dependency indicators:\n' rg -n --hidden -g '!.git' 'fastapi|python_requires|requires-python|python_version|python_requires|Programming Language :: Python|python_version|INSTALL_REQUIRES' . || true

Repository: salimfadhley/dockerized_python_playground

Length of output: 2593

Verify the CI/runtime Python before adopting FastAPI 0.140.8.

FastAPI 0.140.8 requires Python >=3.10, but the repo still defines CI/deployable runs in .travis.yml (python: 3.6) and does not declare a runtime/version constraint elsewhere. Add or update the CI/runtime Python target before installing this dependency.

🧰 Tools

🪛 OSV Scanner (2.4.0)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2022-42992)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-137)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-165)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2024-4)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2162)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2163)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

(GHSA-2f96-g7mh-g2hx)

[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution

(GHSA-2mqj-m65w-jghx)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

(GHSA-3rp5-jjmw-4wv2)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

(GHSA-6p8h-3wgx-97gf)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

(GHSA-7545-fcxq-7j24)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

(GHSA-94p4-4cq8-9g67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: command injection via unguarded Git options in Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()

(GHSA-956x-8gvw-wg5v)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion

(GHSA-cwvm-v4w8-q58c)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

(GHSA-fjr4-x663-mwxc)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation

(GHSA-hcpj-qp55-gfph)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

(GHSA-mv93-w799-cj2w)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

(GHSA-pr76-5cm5-w9cj)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

(GHSA-r9mr-m37c-5fr3)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

(GHSA-rwj8-pgh3-r573)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

(GHSA-v87r-6q3f-2j67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution

(GHSA-wfm5-v35h-vwf4)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation

(GHSA-x2qx-6953-8485)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/requirements.txt` at line 1, Update the repository’s CI/runtime Python target, especially the python version declared in .travis.yml, to Python 3.10 or newer before retaining fastapi==0.140.8 in requirements.txt. Ensure the declared deployable and CI runtime satisfies FastAPI’s minimum version requirement.

coderabbitai · 2026-07-28T11:44:34Z

CVE-2022-24439

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash pip-audit -r src/requirements.txt --strict

Repository: salimfadhley/dockerized_python_playground

Length of output: 226

🏁 Script executed:

#!/bin/bash set -euo pipefail echo "== requirements ==" cat -n src/requirements.txt echo echo "== local pip info if available ==" python3 - <<'PY' import importlib.util, json, urllib.request, urllib.error, os keys = ["fastapi", "gitpython", "uvicorn"] for key in keys: print(f"\n-- {key} --") try: url = f"https://pypi.org/pypi/{key}/json" with urllib.request.urlopen(url, timeout=10) as r: data = json.load(r) info = data.get("info", {}) print("latest:", info.get("version")) releases = list(data.get("releases", {}).keys()) print("release_count:", len(releases)) print("recent:", releases[-5:]) print("selected urls:", sorted( [u.get("filename") for u in data.get("releases", {}).get("3.1.9", []) + data.get("releases", {}).get("0.4.6", []) + data.get("releases", {}).get("3.1.53", []) + data.get("releases", {}).get("0.51.0", [])], key=lambda s:s[:s.rfind("-")] )[:20]) except Exception as e: print("ERROR:", e) print("\n-- pinned package versions in src/requirements.txt --") import re text = open("src/requirements.txt", encoding="utf-8").read() for line in text.splitlines(): line=line.strip() if not line or line.startswith("#"): continue name=re.split(r'[<>=!~\[\];]', line,1)[0].lower().replace("_","-") version=re.search(r'==[^\s,;]+', line) print(f"{name}: {'pinned=' + version.group(0) if version else 'unpinned'}") PY echo echo "== install lockfiles and usage ==" git ls-files | rg '(^|/)(requirements.*\.txt|Pipfile|pyproject\.toml|poetry\.lock|Pipfile\.lock)$|\.py$' || true rg -n "GitPython|gitpython|from git|import git|uvicorn|fastapi" -S .

Repository: salimfadhley/dockerized_python_playground

Length of output: 1337

🌐 Web query:

OSV vulnerabilities GitPython 3.1.9 critical GitPython PyPI

💡 Result:

GitPython version 3.1.9 is significantly outdated and critically vulnerable to multiple security flaws [1][2][3]. Because it lacks years of security patches, it is exposed to several high-severity and critical vulnerabilities, including Remote Code Execution (RCE) and arbitrary file manipulation [1][4][5]. Key security findings for GitPython 3.1.9 include: Remote Code Execution (RCE): Multiple vulnerabilities (e.g., CVE-2022-24439) exist where insufficient sanitization of input arguments allows attackers to inject malicious commands or remote URLs [5][6][3]. Command and Argument Injection: Later discoveries (such as GHSA-956x-8gvw-wg5v and CVE-2026-42215) identified that GitPython failed to properly block dangerous Git options across various methods like Repo.archive, Repo.ls_remote, and others, leading to further RCE vectors [1][4][7]. Arbitrary File Overwrite: Certain methods (e.g., Repo.iter_commits, Repo.blame) allow attackers to clobber arbitrary files on the host system by providing malicious revision strings [1][4]. Environment Variable Exposure: Vulnerabilities exist regarding the handling of remote URLs, where environment variables can be exfiltrated [8]. Given these risks, it is strongly recommended that you upgrade to the latest version of GitPython. Security patches have been released continuously to address these issues, with significant fixes occurring in versions 3.1.30, 3.1.47, 3.1.50, and 3.1.51 [1][2][7][3]. Users should always consult the official PyPI page for the most recent release and review the GitHub security advisories for a complete history of patched vulnerabilities [4][9][10].

Citations:

1: https://osv.dev/vulnerability/GHSA-956x-8gvw-wg5v

2: https://osv.dev/vulnerability/PYSEC-2026-2161

3: https://osv.dev/vulnerability/CVE-2022-24439

4: GHSA-956x-8gvw-wg5v

5: GHSA-hcpj-qp55-gfph

6: https://nvd.nist.gov/vuln/detail/cve-2022-24439

7: https://nvd.nist.gov/vuln/detail/CVE-2026-42215

8: https://osv.dev/vulnerability/GHSA-rwj8-pgh3-r573

9: GHSA-2f96-g7mh-g2hx

10: GHSA-mv93-w799-cj2w

🌐 Web query:

OSV Uvicorn 0.4.6 high severity Uvicorn PyPI

💡 Result:

Uvicorn version 0.4.6 is affected by multiple high-severity vulnerabilities [1][2][3][4]. These security issues were addressed and fixed in Uvicorn version 0.11.7 [5][1][4]. Key vulnerabilities affecting version 0.4.6 include: 1. Log Injection (CVE-2020-7694 / GHSA-33c7-2mpw-hg34): The Uvicorn request logger is vulnerable to ANSI escape sequence injection [1][4]. By sending crafted requests with percent-encoded escape sequences, an attacker can manipulate logs to pollute access logs or interact with the terminal emulator displaying the logs [1][4]. This is classified as high severity [3][4]. 2. HTTP Response Splitting (GHSA-f97h-2pfx-f59f / PYSEC-2020-151): Versions prior to 0.11.7 are vulnerable to HTTP response splitting because CRLF sequences are not correctly escaped in HTTP header values [2][6]. This allows attackers to inject arbitrary headers or return arbitrary response bodies [2][6]. Users running Uvicorn 0.4.6 are strongly advised to upgrade to a patched version (0.11.7 or later) to mitigate these risks [5][1][4].

Citations:

1: https://osv.dev/vulnerability/GHSA-33c7-2mpw-hg34

2: https://osv.dev/vulnerability/PYSEC-2020-151

3: https://deps.dev/pypi/uvicorn/0.4.6

4: GHSA-33c7-2mpw-hg34

5: https://pypi.org/project/uvicorn/0.4.6/

6: https://osv.dev/vulnerability/GHSA-f97h-2pfx-f59f

Upgrade the vulnerable GitPython and Uvicorn dependencies before merging.

This requirements file relies on the current resolver’s default gitpython version and uvicorn==0.4.6, both of which are affected by critical/high-severity security issues. Pin patched, FastAPI-compatible versions—such as a current GitPython release (3.1.53) and Uvicorn 0.51.0—or remove GitPython if it is not needed at runtime.

🧰 Tools

🪛 OSV Scanner (2.4.0)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2022-42992)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-137)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-165)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2024-4)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2162)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2163)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

(GHSA-2f96-g7mh-g2hx)

[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution

(GHSA-2mqj-m65w-jghx)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

(GHSA-3rp5-jjmw-4wv2)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

(GHSA-6p8h-3wgx-97gf)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

(GHSA-7545-fcxq-7j24)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

(GHSA-94p4-4cq8-9g67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: command injection via unguarded Git options in Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()

(GHSA-956x-8gvw-wg5v)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion

(GHSA-cwvm-v4w8-q58c)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

(GHSA-fjr4-x663-mwxc)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation

(GHSA-hcpj-qp55-gfph)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

(GHSA-mv93-w799-cj2w)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

(GHSA-pr76-5cm5-w9cj)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

(GHSA-r9mr-m37c-5fr3)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

(GHSA-rwj8-pgh3-r573)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

(GHSA-v87r-6q3f-2j67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution

(GHSA-wfm5-v35h-vwf4)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation

(GHSA-x2qx-6953-8485)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/requirements.txt` around lines 1 - 3, Update the dependency declarations in requirements.txt to use patched, FastAPI-compatible versions by pinning GitPython to 3.1.53 and Uvicorn to 0.51.0, or remove GitPython if it is not required at runtime; leave the existing FastAPI dependency unchanged.

Source: Linters/SAST tools

-Original file line number
+Diff line change
@@ -1,3 +1,3 @@
-    fastapi==0.6.4
+    fastapi==0.140.8
     gitpython
     uvicorn==0.4.6

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update fastapi to 0.140.8 #609

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Jul 28, 2026

Uh oh!

coderabbitai Bot Jul 28, 2026

Uh oh!

Update fastapi to 0.140.8 #609

Update fastapi to 0.140.8 #609

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!