PT-2026-67303 · Pypi+1 · Gitpython+1
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
GitPython versions prior to 3.1.51
Description
GitPython fails to properly sanitize arguments passed to several public APIs, allowing for command injection and arbitrary file manipulation. The issue occurs because the software does not enforce safety checks on Git options for certain methods, enabling attackers to inject dangerous flags into the underlying
git binary calls.Technical details include:
- Command Execution: The
Repo.archive()method forwards**kwargsverbatim, and thegit.ls remote()method allows theupload packkeyword argument to be passed without validation. An attacker can use options such as--execor--upload-packto execute arbitrary commands on the host system. - Arbitrary File Overwrite: The
Repo.iter commits()andRepo.blame()methods do not check for leading dashes in therevargument. By passing a value like--output=<path>, an attacker can cause Git to open and truncate an arbitrary file on the system.
Exploitation requires an application to pass attacker-controlled arguments to these specific methods.
Recommendations
Update GitPython to version 3.1.51 or later.
As a temporary mitigation, restrict or disable the use of the
Repo.archive(), git.ls remote(), Repo.iter commits(), and Repo.blame() methods if they process untrusted user input.Exploit
Fix
DoS
Command Injection
Argument Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gitpython
Red Os