{"id":"GHSA-wv46-xpj8-pw53","title":"Duplicate Advisory: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution","summary":"Duplicate Advisory: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution","severity":"high","cvss":8.8,"cwe":["CWE-88"],"vendor":"gitpython","product":"gitpython","ecosystem":"pip","affected":["gitpython <= 3.1.57"],"published":"2026-08-19","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:54:50Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-wv46-xpj8-pw53","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76220"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options"},{"url":"https://github.com/advisories/GHSA-wv46-xpj8-pw53"}],"tags":["ghsa","pip"],"ingestedAt":"2026-09-08T21:11:12.321Z","slug":"GHSA-wv46-xpj8-pw53","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-wvpp-8hx9-p66j. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.\n\n## Affected packages\n\n- `gitpython <= 3.1.57`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}