CVE-2026-76220

GitPython before 3.1.58 Command Execution via split_single_char_options

Description

GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.

Scores

Weaknesses (CWE)

• CWE-88

Advisories

• GHSA-wvpp-8hx9-p66j — GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
• PYSEC-2026-3843 — GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

European references

• ENISA EUVD · EUVD-2026-62461
• GCVE · GCVE-0-2026-76220

Affected configurations (NVD CPE)

• cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* < 3.1.58

Affected products

References

• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j
• https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options

Sources