Logo
›
›vulnerability›CVE-2026-76220
Name
CVE-2026-76220
Source
NVD ( link)Debian ( link)
Description
GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.
CWEs
CWE-88
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66jExploit
https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-optionsThird Party Advisory

Analysis#

Affected Component
Analysis
python3-git
Exploitable

Vulnerability Ratings#

8.7
CVSSv4
8.8
CVSSv31
NaN
other

Others affected component#

Name
Project
Project Version
Version
Status
python3-git
yocto
master
3.2.0
Not Affected