{"id":"ghsa-ghsa-w8jc-g24h-crhw","seq":1708808,"kind":"advisory","title":"GitPython command wrappers omit unsafe protocol and option checks","url":"https://github.com/advisories/GHSA-w8jc-g24h-crhw","permalink":"https://vulnpulse.app/items/ghsa-ghsa-w8jc-g24h-crhw","summary":"影響: pip:GitPython <= 3.1.62 → 3.2.0\nGitPython has spent 2022-2026 rolling out two reusable guards method-by-method: Git.check_unsafe_protocols(url) (raises UnsafeProtocolError for :: remote-helper URLs - CVE-2022-24439) and Git.check_unsafe_options(...) (raises UnsafeOptionError for denylisted option spellings - CVE-2023-40267, CVE-2026-42215, CVE-2026-67323). Three wrapper methods that build a git argv from caller-controlled values still have neither: 1. Git.ls_remote (git/cmd.py:1128-1143) - checks options (:1139-1141) but forw…","severity":"high","techs":["python"],"cves":[],"tags":["GHSA-w8jc-g24h-crhw","GitPython"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:26:43.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}