CVE-2021-3028: git-big-picture Remote Code Execution
Summary
CVE-2021-3028: git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution. Affects git-big-picture versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Also tracked for
- git-big-picture · Debian:11
The same CVE-2021-3028 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
git-big-picture is a Python package available on PyPI that provides a visualization tool for Git repositories. It allows users to generate visual representations of the commit history and branch relationships within a Git repository. This vulnerability affects versions prior to 1.0.0 of git-big-picture.
Vulnerability Detail
The vulnerability in git-big-picture arises from mishandling ' characters in a branch name. This can lead to remote code execution, allowing an attacker to execute arbitrary code on the target system. The impact of this vulnerability can be severe, as it grants unauthorized access and control over the affected system.
How To Fix
Latest published version: 1.3.0 as of 22 Oct 2026
pip install --upgrade "git-big-picture==1.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
pip install --upgrade "git-big-picture==1.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of git-big-picture to mitigate the risk of remote code execution.
Conclusion
The vulnerability in git-big-picture allows for remote code execution, posing a significant security risk. It is crucial to update to version 1.0.0 or later of git-big-picture to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for git-big-picture →
FAQ
git-big-picture is a Python package that provides a visualization tool for Git repositories, allowing users to generate visual representations of the commit history and branch relationships.
The vulnerability in git-big-picture can lead to remote code execution, enabling an attacker to execute arbitrary code on the target system. This can result in unauthorized access and control over the affected system.
To fix this vulnerability, it is recommended to update git-big-picture to version 1.0.0 or later. This version includes a fix for the mishandling of ' characters in branch names, preventing the possibility of remote code execution.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of git-big-picture to mitigate the risk of remote code execution.
You can find more information about this vulnerability in the advisory database of the Python Package Index (PyPI) at the following source: https://github.com/pypa/advisory-database/blob/main/vulns/git-big-picture/PYSEC-2021-15.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for git-big-picture.
