8.8Hoch
CVE-2026-73625GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling
Beschreibung
GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.
Schwachstellentyp (CWE):
CWE-78
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| gitpython project | gitpython | < 3.1.54 | |
| gitpython-developers | GitPython | < 3.1.54, fixed 3.1.54 |
Referenzen und Patches
- GitHub Security Advisory (GHSA-r9mr-m37c-5fr3) vendor-advisoryExploitVendor Advisory
- VulnCheck Advisory: GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling third-party-advisoryThird Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*< 3.1.54