Kimi cli: GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing (CVE-2026-87819)

The vulnerability in GitPython arises from the regular expression used to parse commit author and committer fields: (.*) <(.*?)>. This pattern includes an unbounded greedy group followed by a literal space and '<', which leads to catastrophic backtracking when the input contains a long string with an unterminated '<' (no matching '>'). The regex engine performs O(n²) backtracking attempts, causing CPU exhaustion proportional to the square of the input length. This occurs in the Actor._from_string() method whenever .author or .committer properties are accessed. The vulnerability can be triggered by a crafted git commit object with a malformed author or committer field, which can be introduced via object-level injection bypassing git's usual sanity checks. Empirical tests show that input sizes of 200,000 bytes can cause over 150 seconds of processing time per invocation. This enables denial of service against any service using GitPython to process commit metadata from untrusted sources.

The vulnerability causes denial of service by exhausting CPU resources during regex evaluation of commit author or committer fields. This can block GitPython API calls for extended periods (minutes) per invocation, affecting continuous integration systems, code hosting backends, and repository scanning pipelines that process commits from untrusted or third-party sources. There is no impact on confidentiality or integrity, only availability. The vulnerability does not require authentication or user interaction beyond supplying a malicious commit object.

A patch is available for GitPython that fixes this vulnerability. Users should upgrade to a fixed version at or beyond 1.50.0. Until patched, avoid processing untrusted git commit objects with GitPython or apply input validation to limit author/committer field lengths and ensure proper formatting. The vendor advisory confirms a fix is available; therefore, upgrading is the recommended mitigation.