---
schema_version: '1.0'
id: security-20260725-d05ab6
url: https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3
url_hash: d05ab63c3ac93e1934836a8b41dbbb0dcd1a2cfa276f3a6b22d09232e07031b1
canonical_url: https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- GHSA-r9mr-m37c-5fr3
- severity:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- gitpython
- PyPI
lang: en
published_at: '2026-07-24T16:42:57Z'
fetched_at: '2026-07-25T07:04:02.192063Z'
updated_at: '2026-07-25T07:04:18Z'
status: published
content_hash: 3c9b5f8b459a32f1920065f877c5239ddb5966b38909f85295be82bb266f7095
content_changed_at: null
license_note: full
summary: 'GitPython: Unsafe git option guard bypass via single-character kwarg value
  token smuggling enables arbitrary command execution'
summary_source: rss
summary_en: 'GitPython: Unsafe git option guard bypass via single-character kwarg
  value token smuggling enables arbitrary command execution'
entities:
- name: GitPython
  type: artifact
- name: GitHub
  type: organization
- name: Chainguard
  type: organization
key_facts: []
related: []
related_auto:
- name: Block
  type: organization
  weight: 1.0
- name: ブロック
  type: organization
  weight: 1.0
- name: サイオステクノロジー
  type: organization
  weight: 1.0
- name: 日本経済newspaper
  type: UNKNOWN
  weight: 1.0
- name: 日本経済新聞
  type: organization
  weight: 1.0
title: 'GHSA-r9mr-m37c-5fr3: GitPython: Unsafe git option guard bypass via single-character
  kwarg value token smuggling enables arbitrary command execution'
---

# GHSA-r9mr-m37c-5fr3: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

## TL;DR
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

## Key Points
- cve / GHSA-r9mr-m37c-5fr3 / severity:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H / gitpython / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
**Advisory:** GHSA-r9mr-m37c-5fr3

**Affected (your watchlist):**
- `PyPI:gitpython` 3.1.46 → fixed in 3.1.54 [docker/docker-llmwiki]

**Details:**
## Summary
GitPython's `check_unsafe_options` guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since) can be bypassed for **every** guarded method (`clone`/`clone_from`, `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`) by smuggling an option token inside the VALUE of a single-character kwarg. In the default `allow_unsafe_options=False` configuration this yields arbitrary command execution via `--upload-pack`.

## Root Cause
The guard builds its candidate option list from kwarg KEYS only: `_option_candidates([], {"n":"--upload-pack=<cmd>"})` returns `['-n']` (cmd.py:1042-1046 derives the candidate from the key, never the value). `-n` is not on the denylist, so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)` (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=<cmd>']`. git then parses the second token as `--upload-pack` and executes the attacker-supplied command. The guard never inspects the value that becomes a separate argv token.

## Impact
Arbitrary OS command execution as the host process (via `--upload-pack`) in the default configuration, affecting all guarded methods since they all build candidates through the name-only `_option_candidates`.

## Proof of Concept
```python
from git import Repo
Repo.clone_from(bare_repo, out_dir, n="--upload-pack=touch /tmp/ACE;git-upload-pack")
# /tmp/ACE created -> ACE. Direct-name form upload_pack="..." is correctly BLOCKED.
```
File-write variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')` -> candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file truncated.

## Attack Chain
1. Entry: app forwards a user-supplied options dict -> `Repo.clone_from(url, path, n="--upload-pack=touch /tmp/ACE;git-upload-pack")`. Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)` at base.py. Bypass proof: `_option_candidates([], {"n":"--upload-pack=..."})` -> `['-n']` (key-only), not on denylist -> no UnsafeOptionError (verified live).
2. Transform: `transform_kwarg('n', value, split_single_char_options=True)` -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none (guard already passed on name-only candidate). Bypass proof: verified transform emits two tokens.
3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack' -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker created, verified end-to-end).

## Bypass Evidence
Live-verified on HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`; `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from with the payload created the marker file; the direct-name `upload_pack=` form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option, GHSA-x2qx multi-before-split) are BLOCKED on HEAD — this is a distinct kwarg-value->separate-token vector.

## Affected Versions
`<= 3.1.53`

## Suggested Fix
Make `_option_candidates` also emit candidates derived from single-character kwarg VALUES when `split_single_char_options` is in effect, OR run `check_unsafe_options` over the fully-transformed argv rather than the reconstructed name-only candidate list.

---
Reported by **zx (Jace)** — GitHub: @manus-use

**References:**
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3
- https://github.com/gitpython-developers/GitPython/pull/2180
- https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453
- https://github.com/gitpython-developers/GitPython
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3_

## Source
元記事: [GHSA-r9mr-m37c-5fr3: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3) — published 2026-07-24T16:42:57Z