CVE-2026-76220

The record

GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.

Affected packages

Related vulnerabilities

• CVE-2026-79675 NLTK before 3.10.3 fails to validate JVM options passed through the per-call options… CWE-88
• CVE-2026-78676 GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during… CWE-88
• CVE-2026-78678 GitPython versions before 3.1.59 contain an incomplete denylist in the… CWE-88
• CVE-2026-76219 GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in… CWE-88
• CVE-2026-76218 GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that… CWE-88
• CVE-2026-73624 GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the… CWE-88
• CVE-2026-73621 GitPython before 3.1.56 contains an argument injection vulnerability in the… CWE-88
• CVE-2026-54088 File Browser is a file managing interface for uploading, deleting, previewing, renaming… CWE-88