GHSA-cw2r-r7mw-j3hcCritical· 9.8▾ MidnightDuplicate Advisory: GitPython unsafe clone option gate bypass through joined short options
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-v396-v7q4-x2qj. This link is maintained to preserve external references.
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.
gitpython = 3.1.50Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
GHSA-v396-v7q4-x2qjHighGitPython unsafe clone option gate bypass through joined short options
GHSA-6r2r-ww24-7h52High· 8.8Duplicate Advisory: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
CVE-2026-69097High· 7.0GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names
GHSA-6p8h-3wgx-97gfHigh· 7.5GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
GHSA-r9mr-m37c-5fr3High· 8.8GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
GHSA-2f96-g7mh-g2hxHigh· 8.8GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist