CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.51 are vulnerable to command injection due to an incomplete blocklist that does not properly handle git's long-option prefix abbreviation feature. This flaw allows attackers to execute arbitrary commands by exploiting abbreviated option names, potentially leading to unauthorized access or system compromise. Organizations using GitPython should prioritize patching this vulnerability to safeguard their systems against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.