DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-WVPP-8HX9-P66J: GHSA-WVPP-8HX9-P66J: Arbitrary Command Execution via Option Guard Bypass in GitPython

#security #cve #cybersecurity #ghsa

GHSA-WVPP-8HX9-P66J: Arbitrary Command Execution via Option Guard Bypass in GitPython

Vulnerability ID: GHSA-WVPP-8HX9-P66J
CVSS Score: 9.8
Published: 2026-08-07

An unsafe option guard bypass vulnerability exists in GitPython before version 3.1.58. When keyword arguments are passed to Git commands with split_single_char_options=False, GitPython's argument validation helper fails to inspect the combined short-option value. This discrepancy allows short-option token smuggling or clustering manipulation, enabling remote attackers to bypass option blocklists and execute arbitrary system commands.

TL;DR

GitPython prior to 3.1.58 allows arbitrary command execution when executing git commands with split_single_char_options=False due to validation desynchronization.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-88
  • Attack Vector: Network
  • CVSS v3.1: 9.8 (Critical)
  • EPSS Score: N/A
  • Impact: Remote Command Execution (RCE)
  • Exploit Status: Proof of Concept (PoC)
  • CISA KEV Status: Not Listed

Affected Systems

  • GitPython
  • GitPython: < 3.1.58 (Fixed in: 3.1.58)

Code Analysis

Commit: 96a888f

Fix option-guard bypass in _option_candidates

Mitigation Strategies

  • Upgrade GitPython to version 3.1.58 or higher.
  • Sanitize all user-controlled keyword arguments before passing them to GitPython APIs.
  • Implement process isolation by running GitPython in containerized low-privilege environments with restricted network policies.

Remediation Steps:

  1. Identify all Python projects utilizing GitPython by inspecting requirements.txt, setup.py, or poetry.lock.
  2. Execute command 'pip install --upgrade GitPython>=3.1.58' to update the library.
  3. Review source code for instances where GitPython wrappers (e.g., clone, fetch, pull) are called with custom keyword arguments and 'split_single_char_options=False'.
  4. Deploy static analysis rules (such as Semgrep) to enforce secure configurations across developer repositories.

References

Read the full report for GHSA-WVPP-8HX9-P66J on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)