Executive brief
GitPython is a popular Python library used to interact with Git repositories. A security flaw allows an attacker to bypass safety checks and execute arbitrary commands on the host system by providing specially crafted options to common Git operations like cloning or fetching. This could lead to full system compromise or unauthorized data access if the application processes user-supplied repository options.
Technical details
A vulnerability in GitPython's `check_unsafe_options` guard allows for argument injection and subsequent arbitrary command execution. The root cause is that the `_option_candidates` function only inspects keyword argument keys, not their values, when building the denylist validation list. When a single-character kwarg is used (e.g., `n='--upload-pack=...'`), the `transform_kwarg` function splits this into two separate shell tokens. Because the guard only saw the single-character key (which is not denylisted), the smuggled second token is passed directly to the Git binary. Attackers can use the `--upload-pack` or `--output` options to execute OS commands or write to arbitrary files. This is fixed in version 3.1.54.
Affected products
- gitpython-developers GitPython <= 3.1.53
Timeline
- 2026-07-22: patched: Fixed in version 3.1.54
- 2026-07-24: advisory: GitHub Advisory GHSA-r9mr-m37c-5fr3 published