{"id":"ghsa-ghsa-f9j4-qggq-h239","seq":1708807,"kind":"advisory","title":"GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution","url":"https://github.com/advisories/GHSA-f9j4-qggq-h239","permalink":"https://vulnpulse.app/items/ghsa-ghsa-f9j4-qggq-h239","summary":"影響: pip:GitPython >= 3.1.30, < 3.2.0 → 3.2.0\nRemote.pull() in GitPython forwards its positional refspec argument directly to the git pull child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the refspec (for example a user-supplied branch or refspec parameter in a web or CI service) can supply an option-shaped value such as --upload-pack= . The value bypasses the unsafe_git_pull_options check, is placed after the -- separator on the git pull command line, and i…","severity":"high","techs":["python"],"cves":[],"tags":["GHSA-f9j4-qggq-h239","GitPython"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:26:50.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}