CVE-2026-73625

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.54

Description A remote code execution issue exists in the check unsafe options guard. This guard can be bypassed by smuggling git options within single-character kwarg values. An attacker can provide crafted option dictionaries to the clone from, fetch, pull, push, ls remote, iter commits, blame, or archive methods to execute arbitrary OS commands using the --upload-pack parameter.

Recommendations Update GitPython to version 3.1.54 or later.