Vulnerabilities

Security research · GHSA-f9j4-qggq-h239

GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution

Published Oct 27, 2026 · catalog updated Oct 27, 2026 · GitPython Remote.pull() refspec bypasses

Last checked Oct 27, 2026, 9 days ago.

Open the advisory

Exploitation likelihood is not on this record for GHSA-f9j4-qggq-h239. A missing EPSS score is not a low risk. Compare GitPython Remote.pull() refspec bypasses with the linked advisory before you change production.

Severity

High8.1

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

pip GitPython

## Summary in GitPython forwards its positional argument directly to the child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the (for example a user-supplied branch or refspec parameter in a web or CI service) can supply an option-shaped value such as . The value bypasses the check, is placed after the separator on the command line, and is executed as the upload-pack program for local-path or SSH transports. This yields arbitrary command execution with the privileges of the calling process using the documented default arguments ( ). ## Root Cause is documented to reject dangerous options unless , and is explicitly listed as such an option. The guard, however, only screens keyword arguments and never the positional . The check builds its candidate list with , passing an empty list in place of the positionals, so the value is never compared against . The normalized is then forwarded verbatim to the invocation. The leading separator that neutralizes an option-shaped refspec for and does not protect , because re-forwards its trailing positionals to an internal without re-inserting a separator, so the positional becomes an option to that internal fetch. ## Impact An attacker who controls the value passed to achieves arbitrary operating-system command execution as the process invoking GitPython, with no additional privileges and no user interaction, on the default code path. Exploitation requires that the pulled remote uses a transport that runs upload-pack on the local side, namely a local filesystem path or SSH; over HTTPS the value is inert because the server ignores a client-supplied upload-pack program. This transport requirement narrows the population of vulnerable deployments but does not add work for the attacker once a vulnerable target is reached. Working checkouts commonly use local-path or SSH origins, so the exposed population is substantial. ## Proof of Concept Reproduction steps