GHSA-539M-9XH6-Q6RR: GHSA-539m-9xh6-q6rr: Arbitrary File Read and SSRF in GitPython via Missing Argument Denylist Sanitization

#security #cve #cybersecurity #ghsa

GHSA-539m-9xh6-q6rr: Arbitrary File Read and SSRF in GitPython via Missing Argument Denylist Sanitization

Vulnerability ID: GHSA-539M-9XH6-Q6RR
CVSS Score: 6.5
Published: 2026-08-03

An argument injection vulnerability in GitPython allows remote or local attackers with control over repository archive configuration options to retrieve arbitrary local files via native git archive commands. During clone operations, a sibling missing validation vulnerability in the clone option engine allows attackers to perform Server-Side Request Forgery via the git clone bundle-uri mechanism.

TL;DR

GitPython versions <= 3.1.56 are vulnerable to arbitrary file reads and SSRF. By omitting target flags from internal argument validation tables, applications passing user kwargs to Repo.archive() or Repo.clone() can be exploited to retrieve system files or make outbound network requests.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-73
Attack Vector: Network
CVSS v3.1: 6.5
Exploit Status: Proof of Concept
Impact: Arbitrary File Read, Server-Side Request Forgery
Remediation Status: Official Patch Available

Affected Systems

GitPython
GitPython: <= 3.1.56 (Fixed in: 3.1.57)

Code Analysis

Commit: 7a4f5dc

Block --bundle-uri, --add-file, and --add-virtual-file options within internal validation denylists

diff --git a/git/repo/base.py b/git/repo/base.py
index ae99ed5f9..93d17252c 100644
--- a/git/repo/base.py
+++ b/git/repo/base.py
@@ -151,6 +151,8 @@ class Repo:
         "-c",
         # Can install hooks that execute during clone:
         "--template",
+        # Fetches from a caller-controlled URL:
+        "--bundle-uri",
     ]
     """Options to :manpage:`git-clone(1)` that allow arbitrary commands to be executed.

@@ -172,6 +174,10 @@ class Repo:
         # Writes output to a caller-controlled filesystem path.
         "--output",
         "-o",
+        # Reads from a caller-controlled filesystem path:
+        "--add-file",
+        # Injects a caller-controlled path and contents:
+        "--add-virtual-file",
     ]

Exploit Details

GitHub Advisory Database: Details the vulnerability mechanism and lists specific omitted options allowing file write/read vectors

Mitigation Strategies

Upgrade GitPython to version 3.1.57 or newer to resolve missing options in the validation arrays
Replace vulnerable keyword argument delegation with strict parameter allowlists within target application code
Apply localized firewalls or IAM policies preventing build servers from accessing metadata or internal administrative services

Remediation Steps:

Identify all deployment environments running GitPython via pip list or virtual environment audits
Execute pip install --upgrade GitPython>=3.1.57 in target environments
Audit custom source files for calls to Repo.archive() and Repo.clone_from() where third-party input is integrated into keywords
Refactor implementation patterns to enforce validation prior to passing arguments to GitPython wrappers

References

Read the full report for GHSA-539M-9XH6-Q6RR on our website for more details including interactive diagrams and full exploit analysis.

DEV Community