High [CVE-2026-76220] Arbitrary command execution via crafted kwargs

GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False.

Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False. A flaw was found in GitPython.

This allows the attacker to supply a crafted dictionary of keyword arguments to guarded methods, such as `clone_from`, leading to arbitrary operating system command execution.

Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose these method keyword arguments to adversary-controlled input; the vulnerable input cannot be controlled by an attacker in these products, so they are marked not affected.

GitPython as shipped in Red Hat OpenStack Platform 16.2 and 17.1 contains the vulnerable library code and retains its affected determination. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Weakness: CWE-78.

Affected products named by the advisory: Red Hat Satellite 6.19 for RHEL 9; Red Hat Ansible Automation Platform 2.5; Red Hat Ansible Automation Platform 2.6; Red Hat Ansible Automation Platform 2.7; and 1 more.