CVE-2026-76220: GitPython RCE Vulnerability Explained

CVE-2026-76220 Overview

CVE-2026-76220 is a command execution vulnerability in GitPython versions before 3.1.58. The flaw lives in the check_unsafe_options guard, which fails to detect unsafe Git options when a caller combines a single-character kwarg with split_single_char_options=False. An attacker who controls the kwargs dictionary passed to guarded methods such as clone_from can emit a joined token that Git parses as --upload-pack, resulting in arbitrary operating system command execution. The default configuration (allow_unsafe_options=False) does not block the attack. The issue is tracked under CWE-88: Argument Injection.

Critical Impact
Attackers can bypass GitPython's unsafe-option protections to execute arbitrary OS commands through crafted keyword arguments passed to methods like clone_from.

Affected Products

GitPython versions prior to 3.1.58
Python applications invoking Repo.clone_from or other guarded methods with attacker-influenced kwargs
Downstream tooling that treats allow_unsafe_options=False as sufficient hardening

Discovery Timeline

2026-08-19 - CVE-2026-76220 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76220

Vulnerability Analysis

GitPython exposes a safety layer that inspects keyword arguments handed to underlying git subprocess calls. The check_unsafe_options guard is designed to reject dangerous Git flags such as --upload-pack, --receive-pack, --config, and --exec, which can be abused to run arbitrary binaries. When callers pass split_single_char_options=False, the argument transformer joins a single-character kwarg with its value into one token instead of emitting them as separate arguments. The guard inspects the pre-join representation, so a joined token that resolves to --upload-pack=<command> never trips the deny list. GitPython then hands the token to git clone, which honors it and spawns the attacker-supplied command.

Root Cause

The root cause is an ordering and normalization defect between argument validation and argument serialization. The guard evaluates kwargs before the split_single_char_options transformation is applied, so any deny-list entry expressed as a long option (for example --upload-pack) can be smuggled through by supplying it as a single-character kwarg that later expands into the same long form.

Attack Vector

Exploitation requires the ability to influence the kwargs dictionary passed to a guarded GitPython call such as clone_from. Applications that expose repository cloning to authenticated users, CI/CD systems that accept clone parameters from job configuration, and package or plugin managers that forward user input to GitPython are the primary attack surfaces. Successful exploitation yields command execution in the process context running GitPython. Refer to the GitHub Security Advisory GHSA-wvpp-8hx9-p66j and the VulnCheck Advisory for the technical write-up.

Detection Methods for CVE-2026-76220

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running GitPython, particularly shells or interpreters launched under a git clone parent.
Command-line arguments containing --upload-pack= or -u followed by non-standard binaries in Git process telemetry.
Application logs showing clone_from invocations with split_single_char_options=False and attacker-controlled kwargs.

Detection Strategies

Inventory installed GitPython versions across build agents, developer workstations, and application runtimes; flag any version below 3.1.58.
Instrument code paths that call Repo.clone_from and log the resolved argument list before subprocess execution.
Correlate git process launches with their Python parent to identify anomalous option strings.

Monitoring Recommendations

Alert on Git subprocesses whose arguments include --upload-pack, --receive-pack, --exec, or --config when originating from application service accounts.
Monitor CI/CD job definitions for user-supplied fields that reach GitPython without allow-list validation.
Track outbound network connections from short-lived Git operations to detect callback payloads delivered by injected commands.

How to Mitigate CVE-2026-76220

Immediate Actions Required

Upgrade GitPython to 3.1.58 or later in every environment that imports the library.
Audit application code for calls that pass split_single_char_options=False alongside untrusted kwargs and remove that pattern.
Treat allow_unsafe_options=False as insufficient on its own; validate URLs and kwargs against an explicit allow list before invoking GitPython.

Patch Information

The GitPython maintainers fixed the guard in release 3.1.58. Install the fixed version with pip install --upgrade 'GitPython>=3.1.58' and rebuild any container images or lockfiles that pin an earlier release. Full remediation details are in the GitHub Security Advisory GHSA-wvpp-8hx9-p66j.

Workarounds

Strip or reject caller-supplied kwargs before passing them to GitPython methods, especially any single-character keys.
Wrap clone_from and related methods with a validator that rejects Git URLs and kwargs referencing upload-pack, receive-pack, exec, or config.
Run applications that invoke GitPython under least-privilege service accounts with restricted outbound network access to limit blast radius if exploitation occurs.

bash

# Upgrade GitPython to the fixed release
pip install --upgrade 'GitPython>=3.1.58'

# Verify the installed version
python -c "import git; print(git.__version__)"