GitPython EUVD-2026-28411

Applications must accept attacker-controlled input into kwargs dictionaries passed to GitPython's Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push() methods. Vulnerable code pattern: repo.remote('origin').fetch(**user_supplied_dict) or similar constructions where dictionary keys/values originate from untrusted sources (HTTP parameters, API inputs, configuration files writable by lower-privileged users). Attack requires authenticated access (PR:L in CVSS vector) to the application layer invoking GitPython, but does not require local system access or privileged Git repository permissions. Does NOT require allow_unsafe_options=True since the bypass defeats the default False protection. Limits exploitation: applications that hard-code all GitPython kwargs without external input are not vulnerable; applications performing strict kwarg key whitelisting before GitPython invocation prevent the bypass; Python environments without shell command execution capabilities (highly restricted sandboxes) limit impact but do not prevent injection attempts.

CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) indicates network-exploitable command injection requiring authenticated access with no user interaction and high impact across confidentiality, integrity, and availability. Real-world risk depends heavily on application architecture: only affects applications that (1) accept untrusted input into GitPython API kwargs and (2) expose git remote operations to authenticated users. The PR:L requirement significantly reduces attack surface compared to unauthenticated RCE. No CISA KEV listing or EPSS data suggests exploitation remains limited to security research contexts rather than active campaigns. Publicly available exploit code exists (GitHub advisory GHSA-rpm5-65cw-6hj4 with technical details and POC paths). Patch availability in version 3.1.47 since the advisory release enables straightforward remediation. Priority is HIGH for applications exposing GitPython remote operations with user-controlled parameters, MEDIUM for applications using GitPython with authenticated-only access to kwargs, LOW for applications that hard-code all GitPython parameters without external input.

An authenticated attacker with access to a Python application using GitPython identifies a code path where user input controls kwargs passed to remote.fetch(). The attacker crafts a request setting upload_pack='/usr/bin/malicious-script' which bypasses GitPython's unsafe option check due to underscore formatting. When the application executes remote.fetch(upload_pack=attacker_value), Git invokes the attacker's script during the fetch operation, achieving arbitrary command execution in the application's context. GitHub advisory GHSA-rpm5-65cw-6hj4 provides proof-of-concept demonstrating the bypass mechanism.