gitpython: GitPython: Remote Code Execution via kwarg value smuggling

A flaw was found in GitPython. Attackers can bypass the checkunsafeoptions guard by smuggling git options within single-character keyword argument kwarg values. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as clonefrom or fetch, leading to...

PYSEC-2026-3953

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

PYSEC-2026-3953

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

CVE-2026-73625 GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

CVE-2026-73625 GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

CVE-2026-73625 GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

CVE-2026-73625

GitPython before 3.1.54 contains a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, ...