Description

GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T14:17:48.323Z",
  "pubdate": "2026-08-19T14:17:48.323Z",
  "executiveSummary": "An arbitrary command execution vulnerability exists in GitPython before version 3.1.58 due to a logic flaw within the check_unsafe_options security guard.\nThe vulnerability allows remote or local attackers to bypass safety restrictions on guarded methods such as clone_from when default settings of allow_unsafe_options=False are active.\nBy supplying a crafted keyword arguments dictionary that combines a single-character kwarg with split_single_char_options=False, an adversary can emit a joined token that is subsequently parsed as the --upload-pack argument.\nSuccessful exploitation results in arbitrary OS command execution within the context of the application utilizing the affected library.\nThe flaw impacts applications integrating GitPython for repository management tasks, creating significant risk for systems processing untrusted inputs.\nAttackers require the ability to supply malicious keyword arguments to vulnerable GitPython methods, but do not require prior authentication or elevated privileges if the application exposes these parameters to untrusted users.",
  "technicalDetails": "The root cause of the vulnerability resides in the check_unsafe_options validation guard within GitPython, which fails to properly sanitize specific combinations of keyword arguments.\nSpecifically, the validation mechanism can be bypassed by combining a single-character keyword argument with the split_single_char_options=False parameter.\nDuring execution, this combination causes the argument parsing logic to incorrectly construct and emit a joined token that bypasses the security filter and is ultimately parsed as the --upload-pack option.\nThe vulnerable component involves methods like clone_from, which accept dictionary-based keyword arguments meant to be filtered against unsafe command-line options when allow_unsafe_options=False.\nAffected versions include all releases of GitPython prior to 3.1.58.\nExploitation does not require authentication or specific privilege levels if the calling application exposes the vulnerable method parameters to untrusted input sources.\nThe attack flow proceeds as follows: 1) The attacker constructs a malicious kwargs dictionary containing the bypass combination of a single-character kwarg and split_single_char_options=False; 2) The attacker passes this dictionary into a guarded method such as clone_from; 3) The check_unsafe_options guard fails to flag the input as unsafe due to parsing discrepancies; 4) The underlying git subprocess processes the resulting joined token as --upload-pack; 5) The payload executes arbitrary operating system commands specified within the upload-pack argument.\nThe post-exploitation impact includes complete system compromise, arbitrary code execution, and potential unauthorized access to underlying server resources depending on the privileges of the process running GitPython."
}