Loading vulnerability…
GitPython Remote Code Execution via Keyword-Argument Option Smuggling
GitPython versions before 3.1.54 contain an operating-system command injection vulnerability in the check_unsafe_options guard. Attackers can bypass unsafe-option validation by smuggling Git options inside single-character keyword-argument values. Crafted option dictionaries passed to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive can introduce the --upload-pack parameter and trigger arbitrary operating-system command execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of the affected application within its execution privileges. Attackers may read sensitive data, modify application files, or disrupt services. In CI/CD deployments, command execution could expose build credentials or allow tampering with build outputs.
If you can’t patch tonight, do this now.
Until patched, do not pass untrusted option dictionaries or user-controlled keyword-argument values to the affected methods. Use application-controlled option values and a strict allowlist of permitted options. Restrict Git command execution and run the application with minimal privileges to limit potential impact.
Patch, then assume compromise.
Upgrade GitPython and affected distribution packages to a patched release. The vulnerability-specific affected range identifies 3.1.54 as the minimum fixed version, while other remediation guidance specifies 3.1.57. Prefer 3.1.57 or later to cover both stated fix levels and related disclosed vulnerabilities.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.