Bug 2519610 (CVE-2026-76220) - CVE-2026-76220 gitpython: GitPython: Arbitrary command execution via crafted kwargs
Summary: CVE-2026-76220 gitpython: GitPython: Arbitrary command execution via crafted ...
Keywords:
Status: NEW
Alias: CVE-2026-76220
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2525280 2525281
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-19 14:18 UTC by OSIDB Bzimport
Modified: 2026-08-27 20:39 UTC (History)
42 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-19 14:18:51 UTC 
GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.
Note You need to log in before you can comment on or make changes to this bug.