CVE-2026-76220: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in gitpython-developers GitPython

The vulnerability arises because the _option_candidates function only derives value-token candidates when split_single_char_options is true. When false, the guard's candidate list omits the smuggled option, but transform_kwarg emits a joined token that git parses as --upload-pack, enabling arbitrary command execution. This bypasses the denylist check for unsafe options, allowing an attacker to execute OS commands as the host process. The issue affects all guarded methods that forward kwargs and use split_single_char_options=false with a single-character key. The flaw persists in GitPython versions up to and including 3.1.57.

An attacker able to control kwargs passed to GitPython methods with split_single_char_options=false and a single-character key can execute arbitrary OS commands on the host running the GitPython process. This occurs despite the default allow_unsafe_options=false setting, due to the guard bypass. This can lead to full command execution capabilities within the context of the vulnerable application.

No official fix is explicitly stated in the provided data. The suggested fix is to modify _option_candidates to emit value-derived candidates regardless of split_single_char_options or to run the unsafe options check over the fully transformed argv tokens. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid forwarding user-controlled kwargs with split_single_char_options set to false and single-character keys to GitPython guarded methods.