CVE-2026-76220

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58

Description A command execution issue exists in the check unsafe options guard. This guard can be bypassed by combining a single-character kwarg with split single char options=False. An attacker can provide a crafted kwargs dictionary to guarded methods, such as clone from(), to emit a joined token that is parsed as --upload-pack, allowing arbitrary OS command execution even when allow unsafe options is set to False.

Recommendations Update GitPython to version 3.1.58 or later.