Command Execution Vulnerability in GitPython by GitHub

CVE-2026-76220

What is CVE-2026-76220?

GitPython, a popular Python library for interacting with Git repositories, has a vulnerability that allows attackers to execute arbitrary operating system commands. This occurs when utilizing certain guarded methods, specifically when a crafted kwargs dictionary is supplied. By combining a single-character keyword argument with the split_single_char_options set to false, attackers can manipulate command execution paths, bypassing the guard mechanisms designed to prevent such actions. This exploitation could lead to severe security breaches, particularly when the default configuration doesn't enforce safe options.

References