DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-2F96-G7MH-G2HX: GHSA-2F96-G7MH-G2HX: Command Injection Bypass in GitPython Options Validation

#security #cve #cybersecurity #ghsa

GHSA-2F96-G7MH-G2HX: Command Injection Bypass in GitPython Options Validation

Vulnerability ID: GHSA-2F96-G7MH-G2HX
CVSS Score: 8.8
Published: 2026-07-21

GitPython prior to version 3.1.51 contains a command injection vulnerability due to flaws in its option validation routine. By exploiting Git's native argument parser behavior, specifically long-option abbreviation resolution and short-option clustering, attackers can bypass the check_unsafe_options blocklist to execute arbitrary OS commands.

TL;DR

GitPython fails to validate abbreviated long options and clustered short options, allowing attackers to bypass the unsafe option filters and execute arbitrary shell commands.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-78, CWE-184
  • Attack Vector: Network (Remote)
  • CVSS v3.1 Score: 8.8
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • GitPython
  • GitPython: < 3.1.51 (Fixed in: 3.1.51)

Code Analysis

Commit: 5680608

Hardened check_unsafe_options logic in git/cmd.py by analyzing character-by-character values in short options and matching prefix-wise against the canonicalized blocklist.

--- a/git/cmd.py
+++ b/git/cmd.py
@@ -2161,6 +2161,28 @@
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub: GHSA security advisory documenting the GitPython command injection bypass with code walk-throughs.

Mitigation Strategies

  • Upgrade GitPython to version 3.1.51 or newer
  • Avoid passing arbitrary positional or keyword arguments from untrusted inputs to low-level Git commands
  • Enforce strict input whitelisting for all user-supplied repository options and branch parameters

Remediation Steps:

  1. Update requirements.txt or your pip configuration files to declare GitPython>=3.1.51
  2. Inspect applications for usages of allow_unsafe_options=True and eliminate them where possible
  3. Implement a strong regex validation layer restricting user-controlled parameters to alphanumeric characters, slashes, and periods

References

Read the full report for GHSA-2F96-G7MH-G2HX on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)