GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade automation-gateway-configUpgrade automation-gateway-proxy-server-debuginfoUpgrade automation-eda-controller-baseUpgrade automation-gateway-serverUpgrade automation-controller-uiUpgrade python3.12-django-ansible-base+rbacUpgrade receptor-debugsourceUpgrade python3.12-sqlparseUpgrade python3.12-django-ansible-base+activitystreamUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade receptorUpgrade automation-eda-controller-worker-servicesUpgrade receptorctlUpgrade aap-metrics-utilityUpgrade automation-gatewayUpgrade python3.12-django-ansible-base+authenticationUpgrade automation-hubUpgrade python3.12-django-ansible-base+api_documentationUpgrade python3.12-galaxy-ngUpgrade python3-sqlparseUpgrade receptor-debuginfoUpgrade python3.12-django-ansible-base+rest_filtersUpgrade automation-controller-serverUpgrade automation-eda-controller-base-servicesUpgrade automation-platform-uiUpgrade automation-gateway-proxy-serverUpgrade python3.12-gitpythonUpgrade automation-eda-controllerUpgrade python3.12-django-ansible-base+feature_flagsUpgrade python3.12-django-ansible-base+redis_clientUpgrade automation-controller-cliUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3.12-django-ansible-base+channel_authUpgrade python3.12-django-ansible-baseUpgrade automation-eda-controller-event-stream-servicesUpgrade automation-controller-venv-towerUpgrade automation-gateway-proxy-debugsourceUpgrade automation-gateway-proxyUpgrade automation-controllerUpgrade python3.12-django-ansible-base+resource_registry | Sep 25, 2026 | Aug 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub