CVE-2026-76220 in GitPython
Summary
by MITRE • 08/19/2026
GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
GitPython versions prior to 3.1.58 are susceptible to an operating system command injection vulnerability within the check_unsafe_options guard mechanism. This flaw arises from a logic error in how keyword arguments are processed and validated before being passed to underlying git commands. The library is designed with security features intended to prevent unsafe operations, such as arbitrary code execution via maliciously crafted repository URLs or options. However, the specific implementation of this safeguard contains a bypass vector that allows an attacker to circumvent these protections under precise conditions involving argument parsing logic.
The technical root cause lies in the interaction between single-character keyword arguments and the split_single_char_options configuration flag. When developers utilize guarded methods like clone_from with a kwargs dictionary containing single-character keys, and if the internal processing does not correctly normalize or validate these inputs against the expected safe list of options, the validation logic can be tricked. Specifically, by combining a crafted single-character kwarg with the setting split_single_char_options set to False, an attacker can manipulate how tokens are joined and interpreted by the git executable. This manipulation allows the injection of dangerous flags that would normally be blocked or sanitized by the security guard.
The operational impact of this vulnerability is severe, as it enables arbitrary operating system command execution on the host machine where GitPython is running. By exploiting this bypass, an attacker can cause the application to execute unintended git subcommands with elevated privileges relative to the process context. For instance, the crafted input can result in the emission of a joined token that is parsed by the underlying git binary as --upload-pack or similar dangerous options. This effectively grants the attacker control over the command line arguments passed to system-level processes, leading to potential remote code execution, data exfiltration, or complete compromise of the affected server or workstation depending on the privileges of the application running GitPython.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell commands or system utilities. The flaw highlights the critical importance of rigorous input validation and strict allow-lists when interfacing with command-line tools from within application code. Developers must ensure that all dynamic inputs are thoroughly sanitized and that security guards account for edge cases in argument parsing logic to prevent bypasses through unconventional data structures like single-character keyword arguments.
Mitigation requires upgrading GitPython to version 3.1.58 or later, where this specific bypass vector has been addressed by the maintainers. In addition to updating dependencies, developers should review any custom implementations of command execution guards to ensure they do not suffer from similar logic errors. It is advisable to implement defense-in-depth strategies such as running application processes with minimal necessary privileges and using containerization or sandboxing to limit the blast radius in case a vulnerability is exploited. Regular security audits of code that interacts with external binaries are essential to maintain robust security postures against command injection threats.