CVE-2026-76220

Name
CVE-2026-76220
Description
GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j
disclosure@vulncheck.com https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* py3-gitpython >= None < 3.1.58

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
py3-gitpython edge-community 3.1.61-r0 Wen Heping <wenhepingalpine@sohu.com> fixed
py3-gitpython edge-community 3.1.57-r0 Wen Heping <wenhepingalpine@sohu.com> possibly vulnerable
py3-gitpython edge-community 3.1.49-r0 Wen Heping <wenhepingalpine@sohu.com> possibly vulnerable
py3-gitpython edge-community 3.1.46-r1 Wen Heping <wenhepingalpine@sohu.com> possibly vulnerable
py3-gitpython edge-community 3.1.46-r0 Wen Heping <wenhepingalpine@sohu.com> possibly vulnerable
py3-gitpython edge-community 3.1.44-r0 None possibly vulnerable
py3-gitpython edge-community 3.1.43-r1 Bart Ribbers <bribbers@disroot.org> possibly vulnerable
py3-gitpython edge-community 3.1.37-r0 Bart Ribbers <bribbers@disroot.org> possibly vulnerable
py3-gitpython edge-community 3.1.35-r0 Bart Ribbers <bribbers@disroot.org> possibly vulnerable
py3-gitpython 3.24-community 3.1.61-r0 Wen Heping <wenhepingalpine@sohu.com> fixed
py3-gitpython 3.24-community 3.1.49-r0 Wen Heping <wenhepingalpine@sohu.com> possibly vulnerable