https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 04:50:40 +0000 https://vulnerability.circl.lu/vuln/cve-2026-67325 <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git&#39;s long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.</p> <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git&#39;s long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.</p> https://vulnerability.circl.lu/vuln/cve-2026-67325 https://vulnerability.circl.lu/vuln/ghsa-2f96-g7mh-g2hx <p><strong>Affected:</strong> PyPI: GitPython</p> <p>## Command injection via long-option prefix abbreviation bypassing `check_unsafe_options` (incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4)</p> <p>**Component:** gitpython-developers/GitPython (PyPI: GitPython) **Affected:** all versions carrying the 3.1.47 blocklist fix, through current `main` (verified at commit `20c5e275`, `3.1.50-42`) **Reporter:** hackkim</p> <p>### Summary</p> <p>The 3.1.47 fix for CVE-2026-42215 blocks dangerous git options (`--upload-pack`, `--config`, `-c`, `-u` for clone; `--upload-pack` for fetch/pull; `--receive-pack`, `--exec` for push) so callers cannot reach command-executing options unless they pass `allow_unsafe_options=True`.</p> <p>The fix canonicalizes an option name along **one** axis (underscore→hyphen via `dashify`) and checks it against an **exact-match** dict. It does not account for git&#39;s unambiguous long-option prefix abbreviation. Git accepts any unambiguous prefix of a long option (`--upload-p`, `--upload-pa`, `--upload-pac` all resolve to `--upload-pack`). So a kwarg key like `upload_p` canonicalizes to `upload-p`, misses the blocklist dict, and is emitted to git as `--upload-p=&lt;value&gt;` → executed as `--upload-pack=&lt;value&gt;` → command injection, in the default `allow_unsafe_options=False` configuration.</p> <p>### The asymmetry (root cause)</p> <p>```python # git/cmd.py (commit 20c5e275), lines 948-974 @classmethod def _canonicalize_option_name(cls, option): option_name = option.lstrip(&#34;-&#34;).split(&#34;=&#34;, 1)[0] option_tokens = option_name.split(None, 1)…</p> <p><strong>Affected:</strong> PyPI: GitPython</p> <p>## Command injection via long-option prefix abbreviation bypassing `check_unsafe_options` (incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4)</p> <p>**Component:** gitpython-developers/GitPython (PyPI: GitPython) **Affected:** all versions carrying the 3.1.47 blocklist fix, through current `main` (verified at commit `20c5e275`, `3.1.50-42`) **Reporter:** hackkim</p> <p>### Summary</p> <p>The 3.1.47 fix for CVE-2026-42215 blocks dangerous git options (`--upload-pack`, `--config`, `-c`, `-u` for clone; `--upload-pack` for fetch/pull; `--receive-pack`, `--exec` for push) so callers cannot reach command-executing options unless they pass `allow_unsafe_options=True`.</p> <p>The fix canonicalizes an option name along **one** axis (underscore→hyphen via `dashify`) and checks it against an **exact-match** dict. It does not account for git&#39;s unambiguous long-option prefix abbreviation. Git accepts any unambiguous prefix of a long option (`--upload-p`, `--upload-pa`, `--upload-pac` all resolve to `--upload-pack`). So a kwarg key like `upload_p` canonicalizes to `upload-p`, misses the blocklist dict, and is emitted to git as `--upload-p=&lt;value&gt;` → executed as `--upload-pack=&lt;value&gt;` → command injection, in the default `allow_unsafe_options=False` configuration.</p> <p>### The asymmetry (root cause)</p> <p>```python # git/cmd.py (commit 20c5e275), lines 948-974 @classmethod def _canonicalize_option_name(cls, option): option_name = option.lstrip(&#34;-&#34;).split(&#34;=&#34;, 1)[0] option_tokens = option_name.split(None, 1)…</p> https://vulnerability.circl.lu/vuln/ghsa-2f96-g7mh-g2hx https://vulnerability.circl.lu/vuln/pysec-2026-3836 <p><strong>Affected:</strong> PyPI: gitpython</p> <p>## Command injection via long-option prefix abbreviation bypassing `check_unsafe_options` (incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4)</p> <p>**Component:** gitpython-developers/GitPython (PyPI: GitPython) **Affected:** all versions carrying the 3.1.47 blocklist fix, through current `main` (verified at commit `20c5e275`, `3.1.50-42`) **Reporter:** hackkim</p> <p>### Summary</p> <p>The 3.1.47 fix for CVE-2026-42215 blocks dangerous git options (`--upload-pack`, `--config`, `-c`, `-u` for clone; `--upload-pack` for fetch/pull; `--receive-pack`, `--exec` for push) so callers cannot reach command-executing options unless they pass `allow_unsafe_options=True`.</p> <p>The fix canonicalizes an option name along **one** axis (underscore→hyphen via `dashify`) and checks it against an **exact-match** dict. It does not account for git&#39;s unambiguous long-option prefix abbreviation. Git accepts any unambiguous prefix of a long option (`--upload-p`, `--upload-pa`, `--upload-pac` all resolve to `--upload-pack`). So a kwarg key like `upload_p` canonicalizes to `upload-p`, misses the blocklist dict, and is emitted to git as `--upload-p=&lt;value&gt;` → executed as `--upload-pack=&lt;value&gt;` → command injection, in the default `allow_unsafe_options=False` configuration.</p> <p>### The asymmetry (root cause)</p> <p>```python # git/cmd.py (commit 20c5e275), lines 948-974 @classmethod def _canonicalize_option_name(cls, option): option_name = option.lstrip(&#34;-&#34;).split(&#34;=&#34;, 1)[0] option_tokens = option_name.split(None, 1)…</p> <p><strong>Affected:</strong> PyPI: gitpython</p> <p>## Command injection via long-option prefix abbreviation bypassing `check_unsafe_options` (incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4)</p> <p>**Component:** gitpython-developers/GitPython (PyPI: GitPython) **Affected:** all versions carrying the 3.1.47 blocklist fix, through current `main` (verified at commit `20c5e275`, `3.1.50-42`) **Reporter:** hackkim</p> <p>### Summary</p> <p>The 3.1.47 fix for CVE-2026-42215 blocks dangerous git options (`--upload-pack`, `--config`, `-c`, `-u` for clone; `--upload-pack` for fetch/pull; `--receive-pack`, `--exec` for push) so callers cannot reach command-executing options unless they pass `allow_unsafe_options=True`.</p> <p>The fix canonicalizes an option name along **one** axis (underscore→hyphen via `dashify`) and checks it against an **exact-match** dict. It does not account for git&#39;s unambiguous long-option prefix abbreviation. Git accepts any unambiguous prefix of a long option (`--upload-p`, `--upload-pa`, `--upload-pac` all resolve to `--upload-pack`). So a kwarg key like `upload_p` canonicalizes to `upload-p`, misses the blocklist dict, and is emitted to git as `--upload-p=&lt;value&gt;` → executed as `--upload-pack=&lt;value&gt;` → command injection, in the default `allow_unsafe_options=False` configuration.</p> <p>### The asymmetry (root cause)</p> <p>```python # git/cmd.py (commit 20c5e275), lines 948-974 @classmethod def _canonicalize_option_name(cls, option): option_name = option.lstrip(&#34;-&#34;).split(&#34;=&#34;, 1)[0] option_tokens = option_name.split(None, 1)…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3836