GHSA-v396-v7q4-x2qj
ADVISORY - githubSummary
GitPython version 3.1.50 blocks unsafe git clone options such as --upload-pack, -u, --config, and -c unless callers explicitly pass allow_unsafe_options=True. However, the default unsafe-option gate does not recognize joined short-option forms such as -u/path/to/helper.
Git itself accepts -u<upload-pack> as the short form of --upload-pack=<upload-pack>. As a result, Repo.clone_from(..., multi_options=["-u<helper>"], allow_unsafe_options=False) can execute the helper command even though the equivalent long option is blocked.
Affected package:
- Ecosystem: PyPI
- Package:
GitPython - Confirmed affected version:
3.1.50 - Repository:
gitpython-developers/GitPython - Current PyPI version during triage:
3.1.50
Relevant behavior:
Repo.unsafe_git_clone_optionscorrectly lists--upload-pack,-u,--config, and-cas unsafe clone options.Repo._clone()splitsmulti_optionswithshlex.split(" ".join(multi_options))and then callsGit.check_unsafe_options(...)._canonicalize_option_name("-u/path/to/helper")returns a string beginning withu..., not the canonical short optionu, so it does not match the blocked-uentry.- Git accepts the same joined short option as
--upload-pack=<helper>and executes the helper during clone.
Preconditions:
An application must pass attacker-influenced clone options into Repo.clone_from(..., multi_options=...) while relying on GitPython's default unsafe-option gate to block command-executing options.
The local PoC uses only a local bare Git repository and a local helper script. It does not contact any third-party service.
Local reproduction:
The PoC creates a disposable bare Git repository, a helper script, and a sentinel file path. It first confirms that the long --upload-pack=<helper> form is blocked by GitPython. It then calls Repo.clone_from(..., multi_options=["-u<helper>"], allow_unsafe_options=False).
Observed sanitized output:
gitpython_version=3.1.50
git_version=git version 2.53.0.windows.1
tmp_dir=<tmp>
long_upload_pack_gate=BLOCKED:UnsafeOptionError
joined_short_upload_pack_gate=ALLOWED
clone_result=EXPECTED_EXCEPTION:GitCommandError
sentinel_exists=True
sentinel_text=GITPYTHON_UNSAFE_OPTION_BYPASS
The clone fails because the helper exits nonzero, but the sentinel file proves that Git executed the helper despite allow_unsafe_options=False.
Impact:
An attacker who controls multi_options can bypass GitPython's default allow_unsafe_options=False protection and execute a local command via Git's --upload-pack / -u clone option. This is a residual bypass of an explicit GitPython security boundary, not merely a case where a caller opted into unsafe behavior.
Duplicate / related advisory checks:
- OSV query for
PyPI/GitPythonversion3.1.50returned no vulnerabilities. - The repository's public advisories include related unsafe Git option issues, including
GHSA-x2qx-6953-8485/CVE-2026-42284andGHSA-rpm5-65cw-6hj4/CVE-2026-42215. Their public affected ranges are marked as fixed before 3.1.50. GHSA-x2qx-6953-8485describes validatingmulti_optionsbeforeshlex.split(...). GitPython 3.1.50 now validates after splitting, but the joined short option-u<value>still bypasses because the validator canonicalizes it tou<value>rather thanu.GHSA-rpm5-65cw-6hj4describes unsafe underscored kwargs such asupload_pack=.... The current PoC usesmulti_options=["-u<helper>"]against 3.1.50 and does not depend on underscored kwargs.- GitHub issue search for
upload-pack unsafe optionsfound historical related items, including CVE-2022-24439 and the earlier unsafe-options gate work, but no public issue describing this current joined-short-option residual bypass in 3.1.50. - GitHub issue search for
multi_options unsafefound PR #2130, which fixed splitting ofmulti_optionsbefore checking. The current issue remains after that split because-u<value>is treated as option nameu<value>, not blocked short optionu. - GitHub issue searches for
u<upload-pack> unsafeand-cfooreturned no results.
Suggested remediation:
When checking unsafe Git options, parse joined short options that take values. For clone, -uVALUE and -cKEY=VALUE should be canonicalized to u and c respectively before comparing against the unsafe option set.
A safer approach is to maintain command-specific metadata for unsafe short options and recognize the bare option, split form, joined form, and long --option=<value> / --option <value> forms.
Common Weakness Enumeration (CWE)
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
GitHub
-
CVSS SCORE
8.7high| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| gitpython | pypi | - | - | =3.1.50 | 3.1.51 |
CVSS:4 Severity and metrics
The CVSS metrics represent different qualitative aspects of a vulnerability that impact the overall score, as defined by the CVSS Specification.
The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery (IPv6) flood leading to a denial of service on the local LAN segment (e.g., CVE-2013-6014).
Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.
The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges.
There is a total loss of confidentiality, resulting in all information within the Vulnerable System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Vulnerable System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Vulnerable System.
There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Vulnerable System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the Vulnerable System (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.