SB2026072240 - Multiple vulnerabilities in GitPython
Published: July 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Command injection (CVE-ID: N/A)
CWE-ID: CWE-77 - Command injection
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to execute arbitrary commands.
The vulnerability exists due to command injection in Repo.archive() and git.ls_remote() when processing caller-supplied Git options. A remote attacker can supply crafted option values such as exec or upload_pack to execute arbitrary commands.
The command execution occurs under default Git configuration.
2) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: N/A)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to overwrite arbitrary files.
The vulnerability exists due to improper neutralization of argument delimiters in Repo.iter_commits() and Repo.blame() when placing a caller-supplied rev value before the end-of-options separator. A remote attacker can pass a crafted revision value such as a leading-dash option to overwrite arbitrary files.
The target file may be opened and truncated before Git validates the revision value.
3) OS Command Injection (CVE-ID: N/A)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to execute a local command.
The vulnerability exists due to improper neutralization of special elements used in an os command in the Repo.clone_from unsafe clone option gate when processing attacker-influenced clone options in multi_options. A remote user can supply a joined short option such as -u<helper> to execute a local command.
Exploitation requires an application to pass attacker-influenced clone options into Repo.clone_from(..., multi_options=...) while relying on the default unsafe-option gate to block unsafe clone options.
4) Incomplete List of Disallowed Inputs (CVE-ID: N/A)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to incomplete list of disallowed inputs in the check_unsafe_options option validation in GitPython when processing attacker-controlled keyword argument keys for git clone, fetch, pull, or push operations. A remote user can supply a specially crafted abbreviated long option to execute arbitrary code.
Exploitation requires a host application to pass attacker-controlled keyword argument keys into affected GitPython operations while using the default unsafe-option protection.
Remediation
Install update from vendor's website.