8.8Yüksek
CVE-2026-73625GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling
Açıklama
GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.
Zayıflık türü (CWE):
CWE-78
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| gitpython project | gitpython | < 3.1.54 | |
| gitpython-developers | GitPython | < 3.1.54, fixed 3.1.54 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-r9mr-m37c-5fr3) vendor-advisoryExploitVendor Advisory
- VulnCheck Advisory: GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling third-party-advisoryThird Party Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*< 3.1.54