Executive brief
GitPython is a Python library for interacting with Git repositories. GitPython's security gate is designed to block dangerous Git clone options (like --upload-pack) when applications don't explicitly allow unsafe options. However, an attacker can bypass this protection by using a variant form of the dangerous option (-u<helper> instead of --upload-pack=<helper>), allowing them to execute arbitrary commands on a system performing a Git clone with attacker-controlled options.
Technical details
This is an OS command injection vulnerability (CWE-78) in the option validation logic of GitPython's Repo.clone_from() method. The vulnerable component is the _canonicalize_option_name() function which fails to properly parse joined short options. When GitPython checks multi_options against the unsafe-option gate, it canonicalizes option names, but incorrectly treats -u<value> as option name "u<value>" rather than matching it against the blocked short option "u". Since Git itself accepts -u<upload-pack> as a valid short form of --upload-pack=<upload-pack>, the malformed canonicalization allows the bypass. An attacker must be able to control the multi_options parameter passed to Repo.clone_from() while the application relies on the default allow_unsafe_options=False gate to prevent execution. The attack succeeds over the network if the application clones repositories with attacker-influenced options. The vulnerability was fixed in GitPython 3.1.51 by improving the option parsing to recognize all forms of joined short options.
Affected products
- GitPython GitPython 3.1.50
Timeline
- 2026-08-01: disclosed: Published to GitHub Advisory Database (GHSA-v396-v7q4-x2qj primary advisory)
- 2026-08-01: patched: Fixed in GitPython 3.1.51