REDHAT-BUG-2509976: Command Injection

Q: Which applications are realistically exposed?

Applications using GitPython before 3.1.51 are exposed only if they pass attacker-controlled values as keyword arguments to Repo.archive() or git.ls_remote(), or as revision arguments to Repo.iter_commits() or Repo.blame().

Q: What does an attacker need to supply to exploit the command-execution issue?

The attacker must be able to influence Git options passed through the affected methods. Dangerous options include --exec and --upload-pack, which can lead to arbitrary command execution.

Q: What is the impact of the revision-argument issue?

A leading-dash revision such as --output=<path> passed to Repo.iter_commits() or Repo.blame() can cause Git to open and truncate an arbitrary file.

Published Aug 1, 2026

Updated

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.lsremote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.itercommits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.

Affected Software

1 affected component

GitPython GitPython<3.1.51

Event History

Aug 1, 2026

Data Sourced

via Red Hat·01:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are realistically exposed?

Applications using GitPython before 3.1.51 are exposed only if they pass attacker-controlled values as keyword arguments to Repo.archive() or git.ls_remote(), or as revision arguments to Repo.iter_commits() or Repo.blame().

What does an attacker need to supply to exploit the command-execution issue?

The attacker must be able to influence Git options passed through the affected methods. Dangerous options include --exec and --upload-pack, which can lead to arbitrary command execution.

What is the impact of the revision-argument issue?

A leading-dash revision such as --output=<path> passed to Repo.iter_commits() or Repo.blame() can cause Git to open and truncate an arbitrary file.

Are applications safe if they do not accept untrusted Git arguments?

Based on the available information, exploitation requires attacker-controlled arguments to reach the affected methods. Applications that do not pass attacker-controlled values to those method parameters are not described as exploitable.