REDHAT-BUG-2509975: Command Injection

Q: Which GitPython versions require remediation?

GitPython versions before 3.1.51 are affected.

Q: What input should be treated as suspicious when investigating possible exploitation?

Look for abbreviated Git long-option names, such as upload_p, supplied where GitPython invokes Git. Git may resolve these abbreviations to dangerous options that bypass the unsafe-options guard.

Published Aug 1, 2026

Updated

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uploadp instead of uploadpack, which git resolves to dangerous options and executes arbitrary commands.

Affected Software

1 affected component

GitPython GitPython<3.1.51

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GitPython to a version that resolves this vulnerability.
Fixed in 3.1.51

Event History

Aug 1, 2026

Data Sourced

via Red Hat·01:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which GitPython versions require remediation?

GitPython versions before 3.1.51 are affected.

What input should be treated as suspicious when investigating possible exploitation?