GHSA-6R2R-WW24-7H52: gitpython PyPI
Vulnerability summary
GHSA-6R2R-WW24-7H52 is a high (CVSS 8.7) vulnerability in gitpython PyPI.
Not severe (CVSS 8.7, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 01-08-2026PublishedVulnerability first disclosed.
- 08-09-2026Last modifiedVulnerability information updated.
Description
Duplicate Advisory: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2f96-g7mh-g2hx. This link is maintained to preserve external references. ## Original Description GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
PyPI1 product
- gitpython≤ 3.1.50
1 vendor · 1 product
