GitPython Package Reportedly Vulnerable to Command Injection
GitPython package versions 3.1.47 through 3.1.50-42 are reportedly vulnerable to command injection via long-option prefix abbreviation bypass, potentially allowing arbitrary command execution.
What happened
GitPython, a Python library used for interacting with Git repositories, appears to have a critical vulnerability in versions 3.1.47 through 3.1.50-42. This vulnerability, reportedly a command injection via long-option prefix abbreviation bypass, may allow attackers to execute arbitrary commands. The issue is under investigation and is related to an incomplete fix of a previous vulnerability. Engineers using these versions of GitPython in their projects should assess their exposure and consider upgrading to a fixed version or applying the workaround by setting `allow_unsafe_options=False`. For more details, consult the primary sources: [GHSA-2f96-g7mh-g2hx](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx) and [GHSA-3rp5-jjmw-4wv2](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2).
How 0Day mitigates this
GitPython is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.