Alta

GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes atta

Publicada: 21.07.2026
Actualizado: 11.10.2026 15:18

GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	gitpython	>= 3.1.50, < 3.1.51	3.1.51

Referencias

Puntuación CVSS -

Vector CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Debilidad (CWE): CWE-78
Plataforma: Python (PyPI)
Paquete: gitpython
Publicada: 21.07.2026
Actualizado: 11.10.2026 15:18

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-v396-v7q4-x2qj - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2026-3947 - PyPA Advisory Database; CC BY 4.0

Historial de vulnerabilidades: gitpython

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (37) en el archivo

Entradas en total: 37
Primera → última: 12.2022 09.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Crítica 3
Alta 26
Media 8

Divulgaciones por año

2022: 1
2023: 3
2024: 1
2025: 0
2026: 32

09.09.2026

GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

Alta · 7.5 CVE-2026-87819 < 3.1.60 3.1.60
09.09.2026

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

Alta · 8.8 CVE-2026-87817 < 3.1.60 3.1.60
25.08.2026

GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

Crítica · 9.8 CVE-2026-78676 < 3.1.59 3.1.59
25.08.2026

GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

Alta · 7.5 CVE-2026-78677 < 3.1.59 3.1.59
25.08.2026

GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

Alta · 8.4 CVE-2026-78675 < 3.1.59 3.1.59
07.08.2026

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

Alta · 8.8 CVE-2026-76220 < 3.1.58 3.1.58
07.08.2026

GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

Alta · 8.8 CVE-2026-76221 < 3.1.58 3.1.58
07.08.2026

GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

Alta · 8.2 CVE-2026-76222 < 3.1.58 3.1.58
07.08.2026

GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

Alta · 7.5 CVE-2026-76218 < 3.1.58 3.1.58
07.08.2026

GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

Alta · 8.1 CVE-2026-76219 < 3.1.58 3.1.58
03.08.2026

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

Alta · 8.1 CVE-2026-73620 < 3.1.57 3.1.57
24.07.2026

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

Alta · 7.5 CVE-2026-73622 < 3.1.55 3.1.55
24.07.2026

GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

Alta · 8.8 CVE-2026-73625 < 3.1.54 3.1.54
24.07.2026

GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

Alta · 7.5 CVE-2026-73623 < 3.1.54 3.1.54
24.07.2026

GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

Alta · 8.1 CVE-2026-73624 < 3.1.54 3.1.54
24.07.2026

GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

Alta · 7.0 CVE-2026-69097 < 3.1.53 3.1.53
21.07.2026

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

Alta · 7.5 CVE-2026-67322 < 3.1.52 3.1.52
21.07.2026

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

Alta · 8.4 CVE-2026-67323 < 3.1.51 3.1.51
21.07.2026

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Alta · 8.8 CVE-2026-67325 < 3.1.51 3.1.51
21.07.2026

GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes atta esta entrada

Alta CVE-2026-67324 >= 3.1.50, < 3.1.51 3.1.51

Mostrar más (9) Mostrando 20 de 29

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación