StackRadar

CVE-2023-40267

Critical

Advisory

Published 11 Aug 2023In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.012
66th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
24
of 17,781 indexed, latest versions
Container images
20
deployed by those charts
Fix available
1 of 1
affected package

GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

Carried by container images the latest versions of 24 of 17,781 indexed charts deploy, on 20 images.

Affected packageAffected versionsFixed inImages
gitpythonpypi3.1.0, 3.1.7, 3.1.11, 3.1.17+5 more3.1.3220
OSV records
GHSA-pr76-5cm5-w9cj
Also known as
PYSEC-2023-137

Charts affected

24 by stars
ChartLatestAffected imagesRadar Score
ambassadordatawire6.9.51 of 2See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
gitpython@3.1.11
3.1.32

Open the chart page →

4,086
emissary-ingressdatawire7.1.8-ea1 of 1See more

emissary-ingress datawire 7.1.8-ea

1 of the 1 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
datawire/emissary:2.0.2-ea9716efbdd24b
gitpython@3.1.11
3.1.32

Open the chart page →

4,918
edge-stackdatawire7.1.8-ea1 of 2See more

edge-stack datawire 7.1.8-ea

1 of the 2 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
datawire/aes:2.0.3-ea07f8fe4f4f8e
gitpython@3.1.11
3.1.32

Open the chart page →

5,173
weblatedeliveryheroVerified publisher0.3.21 of 3See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
gitpython@3.1.7
3.1.32

Open the chart page →

7,984
deepstackgeek-cookbookVerified publisher1.5.21 of 2See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
robmarkcole/deepstack-ui:latest410275726459
gitpython@3.1.18
3.1.32

Open the chart page →

5,305
mlflow-controllermlflow-deployment-controller0.1.82 of 2See more

mlflow-controller mlflow-deployment-controller 0.1.8

2 of the 2 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
gitpython@3.1.31
3.1.32
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
gitpython@3.1.31
3.1.32

Open the chart page →

8,957
mlflow-servermlflowserver0.1.91 of 3See more

mlflow-server mlflowserver 0.1.9

1 of the 3 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
buntha/mlflow:2.1.1154542cc3083
gitpython@3.1.29
3.1.32

Open the chart page →

5,804
ambassadorazureorkestra6.7.91 of 2See more

ambassador azureorkestra 6.7.9

1 of the 2 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
datawire/aes:1.13.62beb65062c8b
gitpython@3.1.11
3.1.32

Open the chart page →

5,521
cloudlaunchcloudve0.6.01 of 5See more

cloudlaunch cloudve 0.6.0

1 of the 5 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
gitpython@3.1.24
3.1.32

Open the chart page →

12,457
cloudlaunch-servercloudve0.2.01 of 5See more

cloudlaunch-server cloudve 0.2.0

1 of the 5 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
gitpython@3.1.24
3.1.32

Open the chart page →

12,131
cloudlaunchservercloudve0.6.01 of 4See more

cloudlaunchserver cloudve 0.6.0

1 of the 4 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
gitpython@3.1.24
3.1.32

Open the chart page →

11,592
galaxykubemancloudve2.10.11 of 7See more

galaxykubeman cloudve 2.10.1

1 of the 7 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
galaxy/cloudman-server:lateste5c265fe9fcd
gitpython@3.1.27
3.1.32

Open the chart page →

16,069
mlflowdeliveryheroVerified publisher1.0.101 of 1See more

mlflow deliveryhero 1.0.10

1 of the 1 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
larribas/mlflow:1.9.105ccb0b46bfb
gitpython@3.1.7
3.1.32

Open the chart page →

4,422
mlflowhelm-charts-nr1.0.101 of 1See more

mlflow helm-charts-nr 1.0.10

1 of the 1 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
larribas/mlflow:1.9.105ccb0b46bfb
gitpython@3.1.7
3.1.32

Open the chart page →

4,422
weblatehelm-charts-nr0.3.21 of 3See more

weblate helm-charts-nr 0.3.2

1 of the 3 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
gitpython@3.1.7
3.1.32

Open the chart page →

7,984
erpnextimprowisedVerified publisher3.3.01 of 3See more

erpnext improwised 3.3.0

1 of the 3 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
improwised/erpnext-worker:v13.4.197280b55cbd4
gitpython@3.1.17
3.1.32

Open the chart page →

6,501
mlflowkelvins0.4.01 of 3See more

mlflow kelvins 0.4.0

1 of the 3 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
kelvinsp/mlflow:1.26.1cd33e6db2a59
gitpython@3.1.27
3.1.32

Open the chart page →

4,156
kyso-nbdimekyso1.0.01 of 1See more

kyso-nbdime kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
kyso/kyso-nbdime:latest4aa9d38ee81d
gitpython@3.1.29
3.1.32

Open the chart page →

2,765
legendlegend0.1.21 of 1See more

legend legend 0.1.2

1 of the 1 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
ghcr.io/grofers/legend:0.1d6e901ad0ebd
gitpython@3.1.0
3.1.32

Open the chart page →

4,067
mlflow-servermlflow-server0.3.01 of 1See more

mlflow-server mlflow-server 0.3.0

1 of the 1 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
gitpython@3.1.31
3.1.32

Open the chart page →

3,158
mlflowmondata-helm-chartsVerified publisher0.2.31 of 1See more

mlflow mondata-helm-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
mondata/mlflow:v2.3.0.s3.gc6f94c6caf8bf
gitpython@3.1.31
3.1.32

Open the chart page →

3,811
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
gitpython@3.1.31
3.1.32

Open the chart page →

5,456
weblateslamdev0.0.111 of 2See more

weblate slamdev 0.0.11

1 of the 2 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
weblate/weblate:3.11.3-182848df56ecd
gitpython@3.1.0
3.1.32

Open the chart page →

8,694
ambassadorwenerme6.9.51 of 2See more

ambassador wenerme 6.9.5

1 of the 2 container images this version deploys carry CVE-2023-40267.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
gitpython@3.1.11
3.1.32

Open the chart page →

4,086

Container images carrying it

20 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
cloudve/cloudlaunch-server:latest4a3d7fae90bb
gitpython@3.1.24
3.1.32
3
datawire/aes:1.14.48588eafe6862
gitpython@3.1.11
3.1.32
2
larribas/mlflow:1.9.105ccb0b46bfb
gitpython@3.1.7
3.1.32
2
weblate/weblate:4.2.2-169c160d37a3c
gitpython@3.1.7
3.1.32
2
buntha/mlflow:2.1.1154542cc3083
gitpython@3.1.29
3.1.32
1
datawire/aes:2.0.3-ea07f8fe4f4f8e
gitpython@3.1.11
3.1.32
1
datawire/aes:1.13.62beb65062c8b
gitpython@3.1.11
3.1.32
1
datawire/emissary:2.0.2-ea9716efbdd24b
gitpython@3.1.11
3.1.32
1
evk02/mlflow:2.2.1ef6ff257ef35
gitpython@3.1.31
3.1.32
1
galaxy/cloudman-server:lateste5c265fe9fcd
gitpython@3.1.27
3.1.32
1
improwised/erpnext-worker:v13.4.197280b55cbd4
gitpython@3.1.17
3.1.32
1
kelvinsp/mlflow:1.26.1cd33e6db2a59
gitpython@3.1.27
3.1.32
1
kyso/kyso-nbdime:latest4aa9d38ee81d
gitpython@3.1.29
3.1.32
1
mondata/mlflow:v2.3.0.s3.gc6f94c6caf8bf
gitpython@3.1.31
3.1.32
1
robmarkcole/deepstack-ui:latest410275726459
gitpython@3.1.18
3.1.32
1
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
gitpython@3.1.31
3.1.32
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
gitpython@3.1.31
3.1.32
1
weblate/weblate:3.11.3-182848df56ecd
gitpython@3.1.0
3.1.32
1
ghcr.io/grofers/legend:0.1d6e901ad0ebd
gitpython@3.1.0
3.1.32
1
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
gitpython@3.1.31
3.1.32
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.