CVE-2026-76220 GitPython before 3.1.58 Command Execution via split_single_char_options

What is CVE-2026-76220?

CVE-2026-76220 is a high-severity vulnerability in gitpython-developers GitPython, published on 19 Aug 2026.

Official description

GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.

Weakness: CWE-88

Which versions are affected by CVE-2026-76220?

3 open source packages ship an affected version, including gitpython and GitPython. It affects 1 product.

Products include Gitpython Project Gitpython.

How do I fix CVE-2026-76220?

Upgrade gitpython to 3.1.58 or later.

Is CVE-2026-76220 being exploited?

There is no known exploitation of CVE-2026-76220 in the wild and no public exploit code.

Other vulnerabilities in gitpython-developers GitPython

• CVE-2023-40267 GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments Critical 9.8
• CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection Critical 9.3
• CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options Critical 9.3
• CVE-2026-42215 GitPython: Command injection via Git options bypass High 8.8
• CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-76220, ECHO-87eb-ed78-e57c, GHSA-wvpp-8hx9-p66j, MINI-5c5r-mm79-45mr, MINI-7cr3-qm5j-pwr8, MINI-8gcm-5443-92cf and 6 more.