GHSA-2f96-g7mh-g2hx: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
(updated )
The 3.1.47 fix for CVE-2026-42215 blocks dangerous git options (--upload-pack, --config, -c, -u for clone; --upload-pack for fetch/pull; --receive-pack, --exec for push) so callers cannot reach command-executing options unless they pass allow_unsafe_options=True.
The fix canonicalizes an option name along one axis (underscore→hyphen via dashify) and checks it against an exact-match dict. It does not account for git’s unambiguous long-option prefix abbreviation. Git accepts any unambiguous prefix of a long option (--upload-p, --upload-pa, --upload-pac all resolve to --upload-pack). So a kwarg key like upload_p canonicalizes to upload-p, misses the blocklist dict, and is emitted to git as --upload-p=<value> → executed as --upload-pack=<value> → command injection, in the default allow_unsafe_options=False configuration.
References
- github.com/advisories/GHSA-2f96-g7mh-g2hx
- github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285
- github.com/gitpython-developers/GitPython/pull/2161
- github.com/gitpython-developers/GitPython/releases/tag/3.1.51
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx
- nvd.nist.gov/vuln/detail/CVE-2026-67325
- www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation
Code Behaviors & Features
Detect and mitigate GHSA-2f96-g7mh-g2hx with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →