CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.58 are susceptible to a command execution vulnerability that allows attackers to bypass security checks by manipulating a single-character keyword argument. This flaw can lead to arbitrary OS command execution when using guarded methods such as clone_from, even with default safety settings enabled. Organizations utilizing GitPython for automation or CI/CD processes should prioritize patching to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.
Related CVEs
Other vulnerabilities affecting the same vendor(s)