Update fastapi to 0.141.1 #615

coderabbitai · 2026-07-29T19:37:19Z

CVE-2020-7695

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash set -euo pipefail echo "== requirements files ==" git ls-files | grep -E '(^|/)requirements.*\.txt$|(^|/)pyproject\.toml$|(^|/)setup\.py$|(^|/)setup\.cfg$' || true echo echo "== uvicorn references ==" rg -n "uvicorn" -S . echo echo "== requirements content ==" for f in $(git ls-files | grep -E '(^|/)requirements.*\.txt$|(^|/)pyproject\.toml$|(^|/)setup\.py$|(^|/)setup\.cfg$'); do echo "--- $f" sed -n '1,220p' "$f" done echo echo "== repository python/runtime hints ==" if [ -f setup.cfg ]; then cat setup.cfg; fi if [ -f pyrightconfig.json ]; then cat pyrightconfig.json; fi if [ -f .python-version ]; then cat .python-version; fi python3 -c "import sys; print(sys.version)"

Repository: salimfadhley/dockerized_python_playground

Length of output: 1701

🌐 Web query:

OSV uvicorn 0.4.6 HTTP response splitting log injection vulnerabilities

💡 Result:

Uvicorn version 0.4.6 is affected by two known security vulnerabilities: HTTP response splitting (CVE-2020-7695) and log injection (CVE-2020-7694) [1][2]. HTTP Response Splitting (CVE-2020-7695) Uvicorn versions before 0.11.7 are vulnerable to HTTP response splitting [3][4][5]. The issue stems from the improper handling of CRLF (carriage return and line feed) sequences in HTTP headers [6][7]. Because these sequences are not properly escaped, an attacker can provide crafted input when constructing headers to inject arbitrary headers or even return an arbitrary response body [3][5][6]. This vulnerability is classified with a high severity rating [7]. Log Injection (CVE-2020-7694) Uvicorn is also affected by a log injection vulnerability [8][9]. The request logger is susceptible to ANSI escape sequence injection [8][10]. When an attacker sends a request with a URL containing percent-encoded escape sequences, Uvicorn logs the URL after it has been decoded, which converts these sequences into characters that can have special meanings in terminal emulators [8][9]. This allows attackers to pollute access logs and potentially interact with the terminal emulator displaying those logs [8][10]. Mitigation Both vulnerabilities are fixed in Uvicorn version 0.11.7 and later [3][4][8]. Users of version 0.4.6 are advised to upgrade to a version at or above 0.11.7 to remediate these security risks [7][8]. If an immediate upgrade is not feasible, potential workarounds for the log injection issue include disabling the request logger or modifying the logging configuration [7].

Citations:

1: https://pypi.org/project/uvicorn/0.4.6/

2: https://www.versioneye.com/Python/uvicorn/0.4.6?sort=released

3: https://osv.dev/vulnerability/PYSEC-2020-151

4: https://osv.dev/vulnerability/GHSA-f97h-2pfx-f59f

5: https://osv.dev/vulnerability/CVE-2020-7695

6: https://nvd.nist.gov/vuln/detail/cve-2020-7695

7: https://vulert.com/vuln-db/pypi-uvicorn-14569

8: https://osv.dev/vulnerability/GHSA-33c7-2mpw-hg34

9: GHSA-33c7-2mpw-hg34

10: https://nvd.nist.gov/vuln/detail/cve-2020-7694

Upgrade the pinned Uvicorn dependency.

uvicorn==0.4.6 is still in src/requirements.txt and is affected by CVE-2020-7695 (HTTP response splitting) and CVE-2020-7694 (log injection). Upgrade to a patched release compatible with Python 3.9 and validate the startup path.

🧰 Tools

🪛 OSV Scanner (2.4.0)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2022-42992)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-137)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-165)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2024-4)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2162)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2163)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

(GHSA-2f96-g7mh-g2hx)

[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution

(GHSA-2mqj-m65w-jghx)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

(GHSA-3rp5-jjmw-4wv2)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

(GHSA-6p8h-3wgx-97gf)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

(GHSA-7545-fcxq-7j24)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

(GHSA-94p4-4cq8-9g67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: command injection via unguarded Git options in Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()

(GHSA-956x-8gvw-wg5v)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion

(GHSA-cwvm-v4w8-q58c)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

(GHSA-fjr4-x663-mwxc)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation

(GHSA-hcpj-qp55-gfph)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

(GHSA-mv93-w799-cj2w)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

(GHSA-pr76-5cm5-w9cj)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

(GHSA-r9mr-m37c-5fr3)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

(GHSA-rwj8-pgh3-r573)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

(GHSA-v87r-6q3f-2j67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution

(GHSA-wfm5-v35h-vwf4)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation

(GHSA-x2qx-6953-8485)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/requirements.txt` at line 1, Update the pinned Uvicorn dependency in src/requirements.txt from 0.4.6 to a patched release compatible with Python 3.9, then validate the application startup path using that version.

Source: Linters/SAST tools

-Original file line number
+Diff line change
@@ -1,3 +1,3 @@
-    fastapi==0.6.4
+    fastapi==0.141.1
     gitpython
     uvicorn==0.4.6

Navigation Menu

Update fastapi to 0.141.1 #615

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Jul 29, 2026

Uh oh!

Update fastapi to 0.141.1 #615

Uh oh!

Update fastapi to 0.141.1 #615

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!