Skip to content

Update fastapi to 0.141.1 #615

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pyup-bot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update fastapi to 0.141.1 #615

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.141.1

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== requirements files =="
git ls-files | grep -E '(^|/)requirements.*\.txt$|(^|/)pyproject\.toml$|(^|/)setup\.py$|(^|/)setup\.cfg$' || true

echo
echo "== uvicorn references =="
rg -n "uvicorn" -S .

echo
echo "== requirements content =="
for f in $(git ls-files | grep -E '(^|/)requirements.*\.txt$|(^|/)pyproject\.toml$|(^|/)setup\.py$|(^|/)setup\.cfg$'); do
  echo "--- $f"
  sed -n '1,220p' "$f"
done

echo
echo "== repository python/runtime hints =="
if [ -f setup.cfg ]; then cat setup.cfg; fi
if [ -f pyrightconfig.json ]; then cat pyrightconfig.json; fi
if [ -f .python-version ]; then cat .python-version; fi
python3 -c "import sys; print(sys.version)"

Repository: salimfadhley/dockerized_python_playground

Length of output: 1701

🌐 Web query:

OSV uvicorn 0.4.6 HTTP response splitting log injection vulnerabilities

💡 Result:

Uvicorn version 0.4.6 is affected by two known security vulnerabilities: HTTP response splitting (CVE-2020-7695) and log injection (CVE-2020-7694) [1][2]. HTTP Response Splitting (CVE-2020-7695) Uvicorn versions before 0.11.7 are vulnerable to HTTP response splitting [3][4][5]. The issue stems from the improper handling of CRLF (carriage return and line feed) sequences in HTTP headers [6][7]. Because these sequences are not properly escaped, an attacker can provide crafted input when constructing headers to inject arbitrary headers or even return an arbitrary response body [3][5][6]. This vulnerability is classified with a high severity rating [7]. Log Injection (CVE-2020-7694) Uvicorn is also affected by a log injection vulnerability [8][9]. The request logger is susceptible to ANSI escape sequence injection [8][10]. When an attacker sends a request with a URL containing percent-encoded escape sequences, Uvicorn logs the URL after it has been decoded, which converts these sequences into characters that can have special meanings in terminal emulators [8][9]. This allows attackers to pollute access logs and potentially interact with the terminal emulator displaying those logs [8][10]. Mitigation Both vulnerabilities are fixed in Uvicorn version 0.11.7 and later [3][4][8]. Users of version 0.4.6 are advised to upgrade to a version at or above 0.11.7 to remediate these security risks [7][8]. If an immediate upgrade is not feasible, potential workarounds for the log injection issue include disabling the request logger or modifying the logging configuration [7].

Citations:

Upgrade the pinned Uvicorn dependency.

uvicorn==0.4.6 is still in src/requirements.txt and is affected by CVE-2020-7695 (HTTP response splitting) and CVE-2020-7694 (log injection). Upgrade to a patched release compatible with Python 3.9 and validate the startup path.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2022-42992)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-137)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-165)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2024-4)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2162)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2163)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

(GHSA-2f96-g7mh-g2hx)

[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution

(GHSA-2mqj-m65w-jghx)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

(GHSA-3rp5-jjmw-4wv2)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

(GHSA-6p8h-3wgx-97gf)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

(GHSA-7545-fcxq-7j24)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

(GHSA-94p4-4cq8-9g67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: command injection via unguarded Git options in Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()

(GHSA-956x-8gvw-wg5v)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion

(GHSA-cwvm-v4w8-q58c)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

(GHSA-fjr4-x663-mwxc)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation

(GHSA-hcpj-qp55-gfph)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

(GHSA-mv93-w799-cj2w)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

(GHSA-pr76-5cm5-w9cj)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

(GHSA-r9mr-m37c-5fr3)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

(GHSA-rwj8-pgh3-r573)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

(GHSA-v87r-6q3f-2j67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution

(GHSA-wfm5-v35h-vwf4)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation

(GHSA-x2qx-6953-8485)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` at line 1, Update the pinned Uvicorn dependency in
src/requirements.txt from 0.4.6 to a patched release compatible with Python 3.9,
then validate the application startup path using that version.

Source: Linters/SAST tools

gitpython
uvicorn==0.4.6