CVE-2026-76220
HighCVSS 8.8Summary
GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.
Risk Assessment
An attacker can execute arbitrary commands on the victim's machine, potentially leading to full system compromise.
Recommendation
Upgrade GitPython to version 3.1.58 or later. Avoid using methods with untrusted arguments.
Original NVD description (English source)
GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.