GitPython versions prior to 2.24.3 contain a vulnerability in the config-name validator that allows injection of arbitrary git configuration directives via crafted option names. The validator fails to reject characters such as '=', '#', ';', '[', ']', and whitespace in option names, enabling attackers to forge config directives like core.sshCommand or core.hooksPath. This can lead to remote code execution on subsequent git operations. The issue is fixed in version 2.24.3.
GitPython versions up to 2.24.2 contain a vulnerability that allows bypassing the unsafe git option guard when using split_single_char_options=False. This bypass enables arbitrary OS command execution via crafted short-option tokens, affecting multiple guarded methods such as clone, fetch, and push. The flaw is an incomplete fix of a previous vulnerability and arises because the guard does not detect smuggled options emitted as joined tokens. A fix is available in version 2.24.3.
GitPython versions before 2.24.3 contain a vulnerability in the IndexFile.from_tree, reset, and merge_tree methods where unguarded forwarding of treeish strings to git read-tree allows an attacker to overwrite arbitrary files with a valid git-index blob. This occurs because the methods do not guard against unsafe options or use a '--' separator, enabling injection of the --index-output option to specify an arbitrary output path. The impact is arbitrary file overwrite at the privileges of the host process, potentially destroying or corrupting important files. A fix is available in version 2.24.3.
GitPython's Repo.init() method forwards keyword arguments directly to git init without guarding unsafe options such as --template. This allows an attacker who can control the template path to plant malicious git hooks that execute arbitrary code during subsequent git operations. The vulnerability affects GitPython versions from 2.1.0 up to but not including 2.24.3. A fix is available in version 2.24.3 that adds checks to prevent unsafe options.
GitPython versions from 2.1.0 up to but not including 2.24.3 contain a vulnerability in the IndexFile.remove() and Head.checkout() methods. These methods forward arbitrary keyword arguments into git rm and git checkout commands without proper validation. When used with the --pathspec-from-file option combined with --pathspec-file-nul, this causes Git to treat the entire file as a single NUL-delimited pathspec. If the pathspec does not match any files, the error message returned includes the full contents of the specified file, leading to arbitrary file read disclosure. This vulnerability has a CVSS score of 6.5 (medium severity) and is fixed in version 2.24.3.
GitPython versions up to 3.1.53 contain a vulnerability in the check_unsafe_options guard that can be bypassed by smuggling an option token inside the value of a single-character keyword argument. This allows arbitrary OS command execution via the --upload-pack option in guarded methods such as clone, fetch, pull, and others. The vulnerability arises because the guard only inspects option keys, not values, enabling an attacker to inject malicious commands. A fix is available in version 2.24.0.
GitPython's Diffable.diff() method allows attacker-controlled arguments to be passed directly to git diff commands without proper validation. This enables an attacker to use the --output option to overwrite arbitrary files with diff content at the privilege level of the process. The vulnerability affects versions prior to 2.24.0 and was confirmed on version 3.1.53. A fix is available in version 2.24.0 that adds validation to prevent unsafe options.
GitPython versions up to 3.1.53 have an incomplete denylist for unsafe git clone options that omits the --template option. This omission allows an attacker who can influence clone options and stage a malicious post-checkout hook in a directory to achieve arbitrary command execution during a git clone operation. The vulnerability requires the attacker to have write access to a directory used as a template containing executable hooks. A fix is available in version 2.24.0.
GitPython versions from 2.1.0 up to but not including 2.24.0 contain a vulnerability where environment variables in URLs passed to Repo.create_remote() or Remote.add() are expanded and embedded into the repository configuration. This can lead to sensitive environment variables being written into .git/config or .gitmodules and subsequently transmitted to an attacker-controlled host during fetch or pull operations. The issue arises because the fix for a prior vulnerability only disabled environment variable expansion in Repo.clone_from(), but not in Repo.create_remote() or Remote.add(), which still use a helper function with environment variable expansion enabled by default.
GitPython versions from 2.1.0 up to but not including 2.24.0 contain a vulnerability in the Commit.count() method where unguarded forwarding of keyword arguments to git rev-list allows arbitrary file truncation. Specifically, the --output option can be injected to truncate a specified file to zero bytes, causing integrity and availability impact. This issue is due to missing unsafe option checks in Commit.count(), unlike sibling methods that have such guards. A fix is available in version 2.24.0.
GitPython versions from 2.1.0 up to but not including 2.24.0 contain unguarded forwarding of git command options in certain API methods, allowing arbitrary file overwrite and arbitrary file read. Specifically, the IndexFile.checkout() method forwards unsafe options to git checkout-index, enabling an attacker to overwrite files anywhere on the filesystem with repository-controlled content. The TagReference.create() method forwards unsafe options to git tag, allowing reading of arbitrary files on the filesystem and returning their contents in-band. These vulnerabilities are rated high severity due to the potential for arbitrary file overwrite leading to code execution and unauthorized file disclosure. A fix is available in GitPython version 2.24.0.
GitPython's Repo.archive() method uses a denylist to block unsafe git archive options that could lead to security issues. However, the denylist is incomplete and omits the options --add-file and --add-virtual-file, which allow reading arbitrary files from the filesystem and injecting attacker-controlled content into archives. This flaw enables an attacker who can influence Repo.archive() options to read arbitrary files with the privileges of the running process. The vulnerability does not allow code execution but exposes sensitive file contents. A fix is available in GitPython version 2.24.0.
GitPython versions up to 3.1.52 contain a vulnerability where attacker-controlled submodule names can inject arbitrary configuration directives into the .git/config file. This occurs because section names are not properly escaped, allowing injection of directives like core.sshCommand, which can lead to remote code execution on the next git operation. The flaw is fixed in version 3.1.53.
A vulnerability in GitPython's config_writer() allows newline injection in the section parameter, bypassing the patch for CVE-2026-42215. This enables an attacker to inject arbitrary section headers into the .git/config file, including a forged [core] section with hooksPath pointing to an attacker-controlled directory. This leads to remote code execution (RCE) when any git hook is triggered. The issue affects versions >=2.1.0 <2.9.5 and >=2.10.0 <2.18.0 and is fixed in versions 2.9.5 and 2.18.0.
GitPython versions from 2.1.0 up to but not including 2.21.0 contain a command injection vulnerability due to incomplete blocking of dangerous git options. The vulnerability arises because the fix for CVE-2026-42215 only blocks exact matches of unsafe options, but git accepts unambiguous long-option prefix abbreviations that bypass this check. This allows attacker-controlled keyword argument keys to be interpreted as dangerous git options, leading to remote code execution during clone, fetch, pull, or push operations.
GitPython version 3.1.50 contains a vulnerability where the unsafe clone option gate can be bypassed using joined short options such as '-u<helper>'. This bypass allows execution of local commands via Git's upload-pack clone option despite the default protection that blocks unsafe options unless explicitly allowed. The issue arises because the canonicalization of joined short options does not correctly identify them as unsafe, permitting execution of potentially malicious helper commands during cloning.
GitPython versions from 2.1.0 up to but not including 2.21.0 contain command injection vulnerabilities via unguarded Git options in methods such as Repo.archive(), git.ls_remote(), and others. These flaws allow an attacker to execute arbitrary commands or cause file truncation by injecting malicious options or revision strings. The issue arises because certain GitPython methods do not properly validate or restrict user-supplied arguments that are passed directly to Git commands. A fix is available in version 2.21.0.
GitPython versions up to 3.1.50 contain a vulnerability where the Repo.clone_from() method expands environment variables in the remote URL using os.path.expandvars(). This allows an attacker controlling the URL argument to embed environment variable tokens that get expanded to secret values from the server's environment and sent to an attacker-controlled host. The flaw arises because polish_url() applies environment variable expansion indiscriminately to URLs, causing secret leakage without any precondition beyond URL submission. A fix is available in version 2.23.0.
The MCP Python SDK's deprecated WebSocket server transport does not validate Host or Origin headers during the WebSocket handshake, allowing any web page to connect and issue JSON-RPC requests if the server is exposed. This can lead to unauthorized access to server tools and resources if no additional authentication or origin checks are in place. The vulnerability affects versions from 1.1.1 up to but not including 2.18.3. The issue is fixed in version 2.18.3 by adding optional security settings for header validation. The recommended mitigation is to upgrade and configure these settings or migrate to the Streamable HTTP transport, which enforces such protections automatically. The WebSocket transport is removed entirely in version 2.
The MCP Python SDK's experimental task handlers feature, when enabled via server.experimental.enable_tasks(), does not verify task ownership by client session. This allows any connected client to list, read results from, and cancel tasks created by other clients on the same server. The issue affects versions from 1.1.1 up to but not including 2.17.0. The vulnerability is fixed in version 2.17.0 by embedding a per-session marker in task IDs and restricting handlers to operate only on tasks belonging to the requesting session.