Description

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T12:17:27.753Z",
  "pubdate": "2026-08-13T12:17:27.753Z",
  "executiveSummary": "GitPython versions prior to 3.1.54 contain a remote code execution vulnerability residing within the check_unsafe_options security guard.\nThe vulnerability allows remote code execution through option smuggling via single-character keyword argument values.\nAttackers can supply specifically crafted option dictionaries to methods such as clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive.\nSuccessful exploitation enables malicious actors to execute arbitrary operating system commands by leveraging the --upload-pack parameter.\nThis flaw introduces critical risk implications for applications processing untrusted repository inputs or exposed parameters.\nAttack capabilities require supplying crafted option dictionaries to vulnerable methods without necessitating authentication if exposed to external inputs.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and validation within the check_unsafe_options guard mechanism of GitPython.\nThe vulnerable components include the check_unsafe_options implementation and the argument parsing logic handling keyword arguments passed to GitPython methods.\nAffected software versions comprise all GitPython releases prior to version 3.1.54.\nThe exploitation method relies on smuggling dangerous git options inside single-character kwarg values, thereby bypassing the existing validation routines designed to block unsafe command-line arguments.\nThe attack flow proceeds as follows: an attacker supplies a crafted option dictionary containing smuggled parameters to one of the vulnerable methods, including clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive.\nBecause the check_unsafe_options guard fails to detect the smuggled options encapsulated within single-character keyword argument values, the underlying subprocess invocation constructs git commands containing the forbidden arguments.\nSpecifically, attackers leverage the --upload-pack parameter to execute arbitrary OS commands on the host executing the Python process.\nThe payload behavior involves interpreting the injected parameters as valid configuration or execution flags by the underlying git binary.\nPost-exploitation impact includes full remote code execution under the privileges of the user running the Python application, potentially leading to system compromise, data exfiltration, or lateral movement.\nAuthentication and privilege requirements depend entirely on the application architecture exposing the vulnerable GitPython methods, though network exposure exists wherever untrusted input reaches these functions."
}