CVE-2021-3028: 
Python vulnerability analysis and mitigation

CVE-2021-3028 affects git-big-picture versions before 1.0.0. The vulnerability was discovered in early 2021 and involves improper handling of single quote characters in branch names, which could lead to code execution (NVD).

The vulnerability stems from improper input validation (CWE-20) in git-big-picture's handling of branch names containing single quote characters. The CVSS v3.1 base score is 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability could allow an attacker to execute arbitrary code through specially crafted branch names containing single quotes. The vulnerability affects the core functionality of git-big-picture and could lead to system compromise (GitHub PR).

The vulnerability can be exploited by creating a branch name containing malicious code with single quotes. A proof of concept exists: git branch "',subprocess.call('echo'+chr(32)+'owned',shell=True),'" which demonstrates code execution capability (GitHub PR).

The vulnerability was fixed in version 1.0.0 of git-big-picture. The fix involves using Git's --python format option for proper escaping of special characters in branch names. Users should upgrade to version 1.0.0 or later to protect against this vulnerability (GitHub Release).