Improper Neutralization of Argument Delimiters in a Command in GitPython - #VU139085
Published: July 22, 2026
Vulnerability identifier: #VU139085
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-88
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to overwrite arbitrary files.
The vulnerability exists due to improper neutralization of argument delimiters in Repo.iter_commits() and Repo.blame() when placing a caller-supplied rev value before the end-of-options separator. A remote attacker can pass a crafted revision value such as a leading-dash option to overwrite arbitrary files.
The target file may be opened and truncated before Git validates the revision value.
Affected software
GitPython
Remediation
Install security update from vendor's website.
GitPython - update to 3.1.51