GHSA-956x-8gvw-wg5v: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
(updated )
GitPython already know that –upload-pack / –exec are command-exec vectors, they are denylist in git/remote.py:535 and check by Git.check_unsafe_options() (git/cmd.py:963), the thing is this check him he is only call from fetch, pull, push and clone_from, everything else who build a git argv from caller values just go through, no check, three examples
References
- github.com/advisories/GHSA-956x-8gvw-wg5v
- github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738
- github.com/gitpython-developers/GitPython/pull/2163
- github.com/gitpython-developers/GitPython/releases/tag/3.1.51
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v
- nvd.nist.gov/vuln/detail/CVE-2026-67323
- www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options
Code Behaviors & Features
Detect and mitigate GHSA-956x-8gvw-wg5v with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →