CWE-88
AllowedImproper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Abstraction: Base · Status: Draft
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
717 vulnerabilities reference this CWE, most recent first.
GHSA-W9PM-7CXW-VW6J
Vulnerability from github – Published: 2024-08-27 15:32 – Updated: 2024-08-27 15:32The product allows user input to control or influence paths or file names that are used in filesystem operations, allowing the attacker to access or modify system files or other files that are critical to the application.
{
"affected": [],
"aliases": [
"CVE-2024-3980"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-88"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-27T13:15:05Z",
"severity": "CRITICAL"
},
"details": "The product allows user input to control or influence paths or file\nnames that are used in filesystem operations, allowing the attacker to access or modify system files or other files that are\ncritical to the application.",
"id": "GHSA-w9pm-7cxw-vw6j",
"modified": "2024-08-27T15:32:47Z",
"published": "2024-08-27T15:32:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3980"
},
{
"type": "WEB",
"url": "https://publisher.hitachienergy.com/preview?DocumentID=8DBD000160\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W9R8-XH84-C8WX
Vulnerability from github – Published: 2025-01-14 21:31 – Updated: 2025-02-03 18:30Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded Sensitive Data.This issue affects Mediawiki - GlobalBlocking Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
{
"affected": [],
"aliases": [
"CVE-2025-23073"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-88"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-14T19:15:45Z",
"severity": "LOW"
},
"details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded Sensitive Data.This issue affects Mediawiki - GlobalBlocking Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.",
"id": "GHSA-w9r8-xh84-c8wx",
"modified": "2025-02-03T18:30:39Z",
"published": "2025-01-14T21:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23073"
},
{
"type": "WEB",
"url": "https://gerrit.wikimedia.org/r/q/I2a2d32aedf6328be0a9f1b4e04a6567a25f19486"
},
{
"type": "WEB",
"url": "https://phabricator.wikimedia.org/T377855"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WC8M-52QP-MPC9
Vulnerability from github – Published: 2025-06-08 21:30 – Updated: 2025-06-08 21:30Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
{
"affected": [],
"aliases": [
"CVE-2025-35009"
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:32Z",
"severity": "HIGH"
},
"details": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.",
"id": "GHSA-wc8m-52qp-mpc9",
"modified": "2025-06-08T21:30:31Z",
"published": "2025-06-08T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35009"
},
{
"type": "WEB",
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-35009"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WF33-C5J5-V44H
Vulnerability from github – Published: 2026-09-08 21:34 – Updated: 2026-09-08 21:34The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.
{
"affected": [],
"aliases": [
"CVE-2026-78635"
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T21:18:41Z",
"severity": "MODERATE"
},
"details": "The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client\u0027s behavior.",
"id": "GHSA-wf33-c5j5-v44h",
"modified": "2026-09-08T21:34:31Z",
"published": "2026-09-08T21:34:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78635"
},
{
"type": "WEB",
"url": "https://trust.okta.com/security-advisories/improper-input-validation-in-the-okta-privileged-access-ssh-client-url-handler-argument-cve-2026-78635"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-WFRH-GQ5H-5225
Vulnerability from github – Published: 2024-11-13 03:30 – Updated: 2024-11-13 03:30Argument injection in Ivanti Connect Secure before version 22.7R2 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
{
"affected": [],
"aliases": [
"CVE-2024-39710"
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-13T02:15:19Z",
"severity": "CRITICAL"
},
"details": "Argument injection in Ivanti Connect Secure before version 22.7R2 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.",
"id": "GHSA-wfrh-gq5h-5225",
"modified": "2024-11-13T03:30:47Z",
"published": "2024-11-13T03:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39710"
},
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WFRJ-QQC2-83CM
Vulnerability from github – Published: 2021-09-20 19:52 – Updated: 2021-09-17 17:48Impact
Sites using the sendmail transport as part of their mail config are vulnerable to remote command injection due to a vulnerability in the nodemailer dependency.
Ghost defaults to the direct transport so this is only exploitable if the sendmail transport is explicitly used.
Patches
Fixed in 4.15.0, all sites should upgrade as soon as possible.
Workarounds
- Use an alternative email transport as described in the docs.
For more information
If you have any questions or comments about this advisory:
- email us at security@ghost.org
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "ghost"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.15.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-17T17:48:56Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\n\nSites using the `sendmail` transport as part of their `mail` config are vulnerable to remote command injection due to a [vulnerability](https://github.com/advisories/GHSA-48ww-j4fc-435p) in the `nodemailer` dependency.\n\nGhost defaults to the `direct` transport so this is only exploitable if the `sendmail` transport is explicitly used.\n\n### Patches\n\nFixed in 4.15.0, all sites should upgrade as soon as possible.\n\n### Workarounds\n\n* Use an alternative email transport as described in the [docs](https://ghost.org/docs/config/#mail). \n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* email us at security@ghost.org\n",
"id": "GHSA-wfrj-qqc2-83cm",
"modified": "2021-09-17T17:48:56Z",
"published": "2021-09-20T19:52:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-wfrj-qqc2-83cm"
},
{
"type": "WEB",
"url": "https://github.com/TryGhost/Ghost/commit/93e4b2eafd18bc8e4c17924e0824e73617e7940c"
},
{
"type": "PACKAGE",
"url": "https://github.com/TryGhost/Ghost"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-48ww-j4fc-435p"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Remote command injection when using sendmail email transport"
}
GHSA-WGGG-94H3-V43Q
Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2024-04-04 02:34An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the start/stopLaunchDProcess command. The command takes a user-supplied string argument and executes launchctl under root context. A user with local access can use this vulnerability to raise load arbitrary launchD agents. An attacker would need local access to the machine for a successful exploit.
{
"affected": [],
"aliases": [
"CVE-2019-5013"
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-24T16:15:00Z",
"severity": "HIGH"
},
"details": "An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the start/stopLaunchDProcess command. The command takes a user-supplied string argument and executes launchctl under root context. A user with local access can use this vulnerability to raise load arbitrary launchD agents. An attacker would need local access to the machine for a successful exploit.",
"id": "GHSA-wggg-94h3-v43q",
"modified": "2024-04-04T02:34:16Z",
"published": "2022-05-24T16:59:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5013"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0761"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WGW9-G464-RPFH
Vulnerability from github – Published: 2025-10-07 21:31 – Updated: 2025-10-07 21:31Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution. Exploitation may allow privilege escalation to root.
{
"affected": [],
"aliases": [
"CVE-2025-36565"
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-07T20:15:33Z",
"severity": "MODERATE"
},
"details": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027) vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution. Exploitation may allow privilege escalation to root.",
"id": "GHSA-wgw9-g464-rpfh",
"modified": "2025-10-07T21:31:06Z",
"published": "2025-10-07T21:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36565"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WH9F-6QQX-HHHV
Vulnerability from github – Published: 2026-03-30 18:31 – Updated: 2026-03-30 21:31In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to download charts, the chartURL is directly concatenated into the command, allowing attackers to inject wget's --header option to achieve arbitrary HTTP header injection.
{
"affected": [],
"aliases": [
"CVE-2026-29954"
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-30T17:16:15Z",
"severity": "HIGH"
},
"details": "In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to download charts, the chartURL is directly concatenated into the command, allowing attackers to inject wget\u0027s `--header` option to achieve arbitrary HTTP header injection.",
"id": "GHSA-wh9f-6qqx-hhhv",
"modified": "2026-03-30T21:31:03Z",
"published": "2026-03-30T18:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29954"
},
{
"type": "WEB",
"url": "https://gist.github.com/b0b0haha/33baea60fd2a847f11f1fb02e43c64c0"
},
{
"type": "WEB",
"url": "https://github.com/b0b0haha/CVE-2026-29954/blob/main/README.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WHH4-5Q6C-9V3X
Vulnerability from github – Published: 2026-09-30 23:28 – Updated: 2026-09-30 23:28Summary
GitPython 3.1.59 blocks a previously available local-file read path through unsafe git diff options such as -O/--orderfile.
However, the high-level diff API still permits --no-index with the default allow_unsafe_options=False.
--no-index changes the semantics of the paths arguments: instead of repository-relative pathspecs, Git interprets them as arbitrary filesystem paths.
When combined with the still-allowed -I/--ignore-matching-lines option, this creates a content-dependent Boolean oracle over a caller-selected local file.
This was reproduced against the published GitPython 3.1.59 wheel.
The original unsafe-option path is blocked in 3.1.59, while this alternate path remains reachable without setting allow_unsafe_options=True.
Details
Confirmed API surface:
repo.index.diff( None, no_index=True, I=pattern, paths=[baseline_path, target_path], create_patch=True, )
The relevant behavior is:
- --no-index makes the two values supplied via paths filesystem operands rather than repository pathspecs.
- -I/--ignore-matching-lines makes Git's result depend on whether the supplied regular expression matches the relevant file content.
- GitPython exposes the resulting bit through distinguishable behavior:
- matching condition: normal return with an empty DiffIndex
- non-matching condition: GitCommandError with exit status 1
An application that forwards attacker-influenced diff options and paths and exposes the success/error distinction can therefore be queried repeatedly to recover a guessable local single-line secret.
The issue was confirmed with the default allow_unsafe_options=False.
The behavior does not require the caller to explicitly opt into GitPython's unsafe-option mode.
Verified intended security boundary:
- GitPython 3.1.58 accepts the earlier -O/--orderfile local-file input path.
- GitPython 3.1.59 rejects that same path with UnsafeOptionError.
- GitPython 3.1.59 still permits the --no-index alternate path described above.
This appears to be an alternate route to the same local-file confidentiality property that the 3.1.59 diff option hardening is intended to protect.
PoC
A minimal reproducer, controlled extraction demonstrator, proof matrix, and proposed remediation are included in the attached package.
gitpython-3159-maintainer-evidence.zip
The minimal reproducer creates only temporary researcher-controlled files and demonstrates the following predicate:
correct prefix -> normal GitPython return incorrect prefix -> GitCommandError(status=1)
In the controlled extraction test, I generated three independent random single-line values and recovered all three exactly through repeated calls to the GitPython high-level API.
Result: 3/3 recovered.
The extraction harness also installs a Python audit hook that rejects direct Python open() access to the target file during the oracle phase. The content-dependent read is therefore performed by the child git process invoked through GitPython rather than by the reproduction script directly.
Controls were also tested:
- normal repository-scoped diff: no secret disclosure
- same outside paths without --no-index: no arbitrary-filesystem interpretation
- deliberately incorrect predicate: status 1 as expected
Suggested remediation is to classify --no-index as unsafe for the high-level diff API unless the caller explicitly sets allow_unsafe_options=True.
Impact
Potential impact is disclosure of local files readable by the process running GitPython.
Exploitation requires an embedding application to allow an attacker to influence:
- the relevant diff options,
- both path operands, and
- repeated requests while exposing a distinguishable success/error result.
The demonstrated attack is a blind content oracle rather than a one-request in-band file read. It is particularly applicable to short or structured single-line secrets where the target path and approximate value format are known or guessable.
Confirmed affected release: GitPython 3.1.59.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "gitpython"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.59"
},
{
"fixed": "3.1.60"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-88"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-30T23:28:40Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nGitPython 3.1.59 blocks a previously available local-file read path through unsafe git diff options such as -O/--orderfile.\n\nHowever, the high-level diff API still permits --no-index with the default allow_unsafe_options=False.\n\n--no-index changes the semantics of the paths arguments: instead of repository-relative pathspecs, Git interprets them as arbitrary filesystem paths.\n\nWhen combined with the still-allowed -I/--ignore-matching-lines option, this creates a content-dependent Boolean oracle over a caller-selected local file.\n\nThis was reproduced against the published GitPython 3.1.59 wheel.\n\nThe original unsafe-option path is blocked in 3.1.59, while this alternate path remains reachable without setting allow_unsafe_options=True.\n\n### Details\n\nConfirmed API surface:\n\nrepo.index.diff(\n None,\n no_index=True,\n I=pattern,\n paths=[baseline_path, target_path],\n create_patch=True,\n)\n\nThe relevant behavior is:\n\n1. --no-index makes the two values supplied via paths filesystem operands rather than repository pathspecs.\n2. -I/--ignore-matching-lines makes Git\u0027s result depend on whether the supplied regular expression matches the relevant file content.\n3. GitPython exposes the resulting bit through distinguishable behavior:\n - matching condition: normal return with an empty DiffIndex\n - non-matching condition: GitCommandError with exit status 1\n\nAn application that forwards attacker-influenced diff options and paths and exposes the success/error distinction can therefore be queried repeatedly to recover a guessable local single-line secret.\n\nThe issue was confirmed with the default allow_unsafe_options=False.\n\nThe behavior does not require the caller to explicitly opt into GitPython\u0027s unsafe-option mode.\n\nVerified intended security boundary:\n\n- GitPython 3.1.58 accepts the earlier -O/--orderfile local-file input path.\n- GitPython 3.1.59 rejects that same path with UnsafeOptionError.\n- GitPython 3.1.59 still permits the --no-index alternate path described above.\n\nThis appears to be an alternate route to the same local-file confidentiality property that the 3.1.59 diff option hardening is intended to protect.\n\n### PoC\n\nA minimal reproducer, controlled extraction demonstrator, proof matrix, and proposed remediation are included in the attached package.\n\n[gitpython-3159-maintainer-evidence.zip](https://github.com/user-attachments/files/31123571/gitpython-3159-maintainer-evidence.zip)\n\n\nThe minimal reproducer creates only temporary researcher-controlled files and demonstrates the following predicate:\n\ncorrect prefix -\u003e normal GitPython return\nincorrect prefix -\u003e GitCommandError(status=1)\n\nIn the controlled extraction test, I generated three independent random single-line values and recovered all three exactly through repeated calls to the GitPython high-level API.\n\nResult: 3/3 recovered.\n\nThe extraction harness also installs a Python audit hook that rejects direct Python open() access to the target file during the oracle phase. The content-dependent read is therefore performed by the child git process invoked through GitPython rather than by the reproduction script directly.\n\nControls were also tested:\n\n- normal repository-scoped diff: no secret disclosure\n- same outside paths without --no-index: no arbitrary-filesystem interpretation\n- deliberately incorrect predicate: status 1 as expected\n\nSuggested remediation is to classify --no-index as unsafe for the high-level diff API unless the caller explicitly sets allow_unsafe_options=True.\n\n### Impact\n\nPotential impact is disclosure of local files readable by the process running GitPython.\n\nExploitation requires an embedding application to allow an attacker to influence:\n\n1. the relevant diff options,\n2. both path operands, and\n3. repeated requests while exposing a distinguishable success/error result.\n\nThe demonstrated attack is a blind content oracle rather than a one-request in-band file read. It is particularly applicable to short or structured single-line secrets where the target path and approximate value format are known or guessable.\n\nConfirmed affected release: GitPython 3.1.59.",
"id": "GHSA-whh4-5q6c-9v3x",
"modified": "2026-09-30T23:28:40Z",
"published": "2026-09-30T23:28:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-whh4-5q6c-9v3x"
},
{
"type": "WEB",
"url": "https://github.com/gitpython-developers/GitPython/pull/2217"
},
{
"type": "WEB",
"url": "https://github.com/gitpython-developers/GitPython/commit/09f2cf383a992d1af697364569e9f384748c1bd8"
},
{
"type": "PACKAGE",
"url": "https://github.com/gitpython-developers/GitPython"
},
{
"type": "WEB",
"url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3983.yaml"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/gitpython-3.1.59-local-file-content-oracle-via-no-index"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle"
}
Mitigation
Strategy: Parameterization
Where possible, avoid building a single string that contains the command and its arguments. Some languages or frameworks have functions that support specifying independent arguments, e.g. as an array, which is used to automatically perform the appropriate quoting or escaping while building the command. For example, in PHP, escapeshellarg() can be used to escape a single argument to system(), or exec() can be called with an array of arguments. In C, code can often be refactored from using system() - which accepts a single string - to using exec(), which requires separate function arguments for each parameter.
Mitigation
Strategy: Input Validation
Understand all the potential areas where untrusted inputs can enter your product: parameters or arguments, cookies, anything read from the network, environment variables, request headers as well as content, URL components, e-mail, files, databases, and any external systems that provide data to the application. Perform input validation at well-defined interfaces.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation
Directly convert your input type into the expected data type, such as using a conversion function that translates a string into a number. After converting to the expected data type, ensure that the input's values fall within the expected range of allowable values and that multi-field consistencies are maintained.
Mitigation
- Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180, CWE-181). Make sure that your application does not inadvertently decode the same input twice (CWE-174). Such errors could be used to bypass allowlist schemes by introducing dangerous inputs after they have been checked. Use libraries such as the OWASP ESAPI Canonicalization control.
- Consider performing repeated canonicalization until your input does not change any more. This will avoid double-decoding and similar scenarios, but it might inadvertently modify inputs that are allowed to contain properly-encoded dangerous content.
Mitigation
When exchanging data between components, ensure that both components are using the same character encoding. Ensure that the proper encoding is applied at each interface. Explicitly set the encoding you are using whenever the protocol allows you to do so.
Mitigation
When your application combines data from multiple sources, perform the validation after the sources have been combined. The individual data elements may pass the validation step but violate the intended restrictions after they have been combined.
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
CAPEC-137: Parameter Injection
An adversary manipulates the content of request parameters for the purpose of undermining the security of the target. Some parameter encodings use text characters as separators. For example, parameters in a HTTP GET message are encoded as name-value pairs separated by an ampersand (&). If an attacker can supply text strings that are used to fill in these parameters, then they can inject special characters used in the encoding scheme to add or modify parameters. For example, if user input is fed directly into an HTTP GET request and the user provides the value "myInput&new_param=myValue", then the input parameter is set to myInput, but a new parameter (new_param) is also added with a value of myValue. This can significantly change the meaning of the query that is processed by the server. Any encoding scheme where parameters are identified and separated by text characters is potentially vulnerable to this attack - the HTTP GET encoding used above is just one example.
CAPEC-174: Flash Parameter Injection
An adversary takes advantage of improper data validation to inject malicious global parameters into a Flash file embedded within an HTML document. Flash files can leverage user-submitted data to configure the Flash document and access the embedding HTML document.
CAPEC-41: Using Meta-characters in E-mail Headers to Inject Malicious Payloads
This type of attack involves an attacker leveraging meta-characters in email headers to inject improper behavior into email programs. Email software has become increasingly sophisticated and feature-rich. In addition, email applications are ubiquitous and connected directly to the Web making them ideal targets to launch and propagate attacks. As the user demand for new functionality in email applications grows, they become more like browsers with complex rendering and plug in routines. As more email functionality is included and abstracted from the user, this creates opportunities for attackers. Virtually all email applications do not list email header information by default, however the email header contains valuable attacker vectors for the attacker to exploit particularly if the behavior of the email client application is known. Meta-characters are hidden from the user, but can contain scripts, enumerations, probes, and other attacks against the user's system.
CAPEC-460: HTTP Parameter Pollution (HPP)
An adversary adds duplicate HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.
CAPEC-88: OS Command Injection
In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.