CVE-2026-76220
CVE-2026-76220: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh8.8
High [CVE-2026-76220] Arbitrary command execution via crafted kwargs
CVE-2026-76220Source published Source updated
GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False. A flaw was found in GitPython. This allows the attacker to supply a crafted dictionary of keyword arguments to guarded methods, such as `clone_from`, leading to arbitrary operating system command execution. Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose these method keyword arguments to adversary-controlled input; the…
- Affected products in this advisory
- Red Hat Satellite 6.19 for RHEL 9
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
1 more entries in the full advisory.
- Source-reported affected versions
- < 3.1.58
- Source-reported fixed versions
- python3.12-gitpython-0:3.1.59-1.el9pc
- ansible-automation-platform-25/controller-rhel8:1789607021
- ansible-automation-platform-26/controller-rhel9:1789673739
- ansible-automation-platform-27/controller-rhel9:1789580684
12 more entries in the full advisory.
- Mitigation guidance
- Do not pass untrusted or attacker-influenced keyword arguments to GitPython's guarded methods such as clone_from, and do not set split_single_char_options=False on untrusted input. Upgrade to GitPython 3.1.58 or later, where the check_unsafe_options bypass is fixed.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.