Hackkim

**Name of the Vulnerable Software and Affected Versions** GitPython versions prior to 3.1.51 **Description** An incomplete command injection blocklist allows attackers to bypass the unsafe options guard. The issue stems from the `check unsafe options()` function and ` canonicalize option name()` function, which perform exact-match checks and only normalize underscores to hyphens. This fails to account for the long-option prefix abbreviation feature of git, where git accepts any unambiguous prefix of a long option. Attackers can use abbreviated keys such as `upload p` (which git resolves to `--upload-pack`), `receive p` (resolved to `--receive-pack`), or `exe` (resolved to `--exec`) to bypass the guard and execute arbitrary commands. This occurs even when `allow unsafe options` is set to `False`. **Recommendations** Update GitPython to version 3.1.51 or later. As a temporary mitigation, restrict the use of attacker-controlled keys in the `clone`, `fetch`, `pull`, and `push` methods to prevent them from reaching the vulnerable `check unsafe options()` function.