2784 matches found
GHSA-V396-V7Q4-X2QJ GitPython unsafe clone option gate bypass through joined short options
GitPython version 3.1.50 blocks unsafe git clone options such as --upload-pack, -u, --config, and -c unless callers explicitly pass allowunsafeoptions=True. However, the default unsafe-option gate does not recognize joined short-option forms such as -u/path/to/helper. Git itself accepts -u as the...
Command Injection
Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Command Injection via the canonicalizeoptionname function in git/cmd.py. An attacker can execute a local helper command by supplying joined short clone options such as...
GitPython unsafe clone option gate bypass through joined short options
GitPython version 3.1.50 blocks unsafe git clone options such as --upload-pack, -u, --config, and -c unless callers explicitly pass allowunsafeoptions=True. However, the default unsafe-option gate does not recognize joined short-option forms such as -u/path/to/helper. Git itself accepts -u as the...
PT-2026-63797
Summary Repo.clone from passes the caller-supplied remote URL through Git.polish url, which on every non-Cygwin platform calls os.path.expandvars on the URL before handing it to git clone. An attacker who controls the URL argument — the documented use case for clone from in "import repository fro...
GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration
A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...
GitPython: GitPython: Arbitrary code execution via improper validation of clone options
A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the clone function. By crafting a malicious string in the multioptions parameter, an attacker could bypass validation. This allows for the...
GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks
A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments kwargs to functions such as Repo.clonefrom, Remote.fetch, Remote.pull, or Remote.push. This...
GitPython: GitPython: Arbitrary code execution via improper validation of clone options
A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the clone function. By crafting a malicious string in the multioptions parameter, an attacker could bypass validation. This allows for the...
GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration
A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...
GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks
A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments kwargs to functions such as Repo.clonefrom, Remote.fetch, Remote.pull, or Remote.push. This...
PT-2026-67302
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.52 Description GitPython is susceptible to environment-variable exfiltration when using the Repo.clone from function. The issue occurs because the remote URL provided by the user is processed by the Git.polish u...
ROS-20260713-73-0048
The vulnerability in GitPython is related to improper code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20260713-73-0046
The vulnerability in GitPython relates to an incorrect limitation on the path name for restricted access directories. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
ROS-20260713-73-0047
The vulnerability in GitPython is related to the implementation or modification of arguments. Exploiting this vulnerability allows an attacker to execute arbitrary commands...
ROS-20260713-73-0049
The vulnerability of the Repo.clonefrom, Remote.fetch, Remote.pull, and Remote.push functions in the GitPython library for interacting with git repositories is related to the failure to implement measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to...
ROS-20260713-73-0050
The vulnerability in GitPython is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to cause a service failure...
PT-2026-67303
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.51 Description GitPython fails to properly sanitize arguments passed to several public APIs, allowing for command injection and arbitrary file manipulation. The issue occurs because the software does not enforce...
PT-2026-67304
Name of the Vulnerable Software and Affected Versions GitPython version 3.1.50 Description An issue exists where the software fails to recognize joined short-option forms, such as -u, which is the short form of --upload-pack=, when enforcing its default unsafe-option gate. If an application passe...
PT-2026-67305
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.51 Description An incomplete command injection blocklist allows attackers to bypass the unsafe options guard. The issue stems from the check unsafe options function and canonicalize option name function, which...