EUVD-2026-51808
GHSA-cw2r-r7mw-j3hc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Full command execution yields C/I/A:H; AC:H because exploitation depends on a non-default application pattern passing untrusted options into multi_options, and PR:N/UI:N since no GitPython-level auth or interaction is required.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4Blast Radius
ecosystem impact- 55 pypi packages depend on gitpython (48 direct, 7 indirect)
Ecosystem-wide dependent count for version 3.1.50.
DescriptionCVE.org
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.
AnalysisAI
Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-option syntax, letting an attacker who controls clone options smuggle -u<helper> (the short form of --upload-pack=<helper>) past the block on --upload-pack/-u. Applications calling Repo.clone_from with attacker-influenced multi_options and allow_unsafe_options=False are affected, allowing Git to execute an arbitrary helper command during clone despite the safety gate being active. Reported by VulnCheck with a working local proof-of-concept; publicly available exploit code exists, but there is no public exploit identified as used in active attacks and it is not in CISA KEV.
Technical ContextAI
GitPython is a Python library that wraps the git command-line binary, and Repo.clone_from(...) forwards caller-supplied flags to git clone via multi_options. To prevent option-injection, GitPython maintains Repo.unsafe_git_clone_options listing --upload-pack, -u, --config, and -c, and enforces it through Git.check_unsafe_options unless allow_unsafe_options=True. The root cause is CWE-78 (OS Command Injection) via incomplete input neutralization: _clone() runs shlex.split(' '.join(multi_options)) and then _canonicalize_option_name('-u/path/to/helper') returns a token beginning with 'u...' rather than the canonical short option 'u', so it never matches the blocked '-u' entry. Because git natively accepts -u<upload-pack> as the joined short form of --upload-pack=<upload-pack>, and upload-pack designates an executable git runs during clone, the bypass yields direct command execution. Affected CPE is cpe:2.3:a:gitpython-developers:gitpython.
RemediationAI
Vendor-released patch: upgrade GitPython to 3.1.51, which corrects the option-canonicalization so joined short forms like -u<value> are recognized and blocked by the default gate (see the fix in PR https://github.com/gitpython-developers/GitPython/pull/2162 and advisory GHSA-v396-v7q4-x2qj). If you cannot upgrade immediately, do not pass untrusted or attacker-influenced values into Repo.clone_from(..., multi_options=...); sanitize or allowlist clone options and reject any token beginning with -u, --upload-pack, -c, or --config (including joined short forms), accepting the trade-off that legitimate use of those options will be refused. As a defense-in-depth measure, run clone operations under a low-privilege account or sandbox so that any helper git executes has minimal blast radius, noting this contains rather than prevents the bypass.
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
Command injection in GitPython 3.1.30-3.1.46 allows remote authenticated attackers to execute arbitrary commands via und
Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using
Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution vi
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today