Command Injection Affecting gitpython package, versions [3.1.50,3.1.51)

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Command Injection via the _canonicalize_option_name function in git/cmd.py. An attacker can execute a local helper command by supplying joined short clone options such as -u<upload-pack> or -c<config> through Repo.clone_from(..., multi_options=...) while allow_unsafe_options=False is in effect. The vulnerable normalization path only stripped the leading dash and compared the full joined token, so -u/path/to/helper did not match the blocked -u option even though Git treats it as --upload-pack=<helper>. This lets attacker-controlled clone options run the helper during repository cloning, bypassing GitPython’s default unsafe-option protection and causing arbitrary local command execution on the host that performs the clone.

Notes

• The bypass only matters for callers feeding attacker-controlled values into multi_options; ordinary upload_pack= / config= keyword arguments are a separate path and are not the trigger here.
• The vulnerable normalization also missed joined short forms with embedded values such as -u<helper> and -c<key>=<value>; long forms like --upload-pack=... were already handled by the unsafe-option list.

Workarounds

• Ensure untrusted input is not passed into Repo.clone_from(..., multi_options=...); restrict multi_options to trusted, application-defined values so an attacker cannot supply joined short clone options like -u<helper> or -c<key>=<value> to trigger helper execution during clone.

• GitHub Commit
• GitHub PR
• Maintainer's Advisory