{"id":"GHSA-6r2r-ww24-7h52","title":"Duplicate Advisory: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist","summary":"Duplicate Advisory: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist","severity":"high","cvss":8.8,"cwe":["CWE-78"],"vendor":"gitpython","product":"gitpython","ecosystem":"pip","affected":["gitpython <= 3.1.50"],"published":"2026-08-01","updated":"2026-09-08","sourceUpdated":"2026-09-08T17:17:07Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6r2r-ww24-7h52","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation"},{"url":"https://github.com/advisories/GHSA-6r2r-ww24-7h52"}],"tags":["ghsa","pip"],"ingestedAt":"2026-09-08T18:07:34.882Z","slug":"GHSA-6r2r-ww24-7h52","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-2f96-g7mh-g2hx. This link is maintained to preserve external references.\n\n## Original Description\n\nGitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.\n\n## Affected packages\n\n- `gitpython <= 3.1.50`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}