An AI-written fix for unsafe git options left GitPython's ls_remote accepting unsafe ext:: transport URLs, so applications passing an attacker-chosen remote could still run a helper until 3.2.0.

How AI contributed: Flawed AI-written codePublished Jul 12, 2026 in gitpython-developers/gitpythonAll 8 findings in this repository

Provisional finding. Full causal and release verification remains incomplete.

Show full advisory description

GitPython's option guard blocked one external-program option while leaving its equivalent spelling accepted. The repair adds the missing spelling to the blocked options.

What actually happened

GitPython passed caller-supplied options and revisions straight to git in several commands, so an application forwarding them could run a helper program or truncate files. An AI-written fix added option checks to those commands and a dedicated ls_remote wrapper, but the wrapper checked only options and never the remote URL, so an ext:: transport URL could still run a helper through ls_remote. A later fix added the missing protocol check, first released in 3.2.0.

Root cause

Injection & unsafe execution

The new ls-remote option list contains upload-pack without its equivalent exec option.

AI-assisted change: ChatGPT/Codex

701ce32fe5

git/cmd.py

Fix

Security fix

ls_remote now checks remote URLs for unsafe transports such as ext:: unless the caller opts in.

Fix authorship not yet analyzed

9ad28cc4c7

git/cmd.py

Case facts

CVE ID: CVE-2026-67323
GHSA ID: GHSA-956X-8GVW-WG5V
Published: Jul 12, 2026
Severity: high
Language: Python
AI tool: ChatGPT/Codex
AI role: Flawed AI-written code
Vulnerable release: >= 3.1.51, < 3.2.0
Fixed release: 3.2.0

CWE-77 CWE-88

Advisory source

AI-assisted change

AI-assisted changegit/cmd.py source gitpython-developers/gitpython@701ce32fe5+5−0

@@ -649,6 +649,11 @@      re_unsafe_protocol = re.compile(r"(.+)::.+") +    unsafe_git_ls_remote_options = [+        # This option allows arbitrary command execution in git-ls-remote.+        "--upload-pack",+    ]+     def __getstate__(self) -> Dict[str, Any]:

Show 2 hidden lines

         return slots_to_dict(self, exclude=self._excluded_)

The new ls-remote option list contains upload-pack without its equivalent exec option.

Security fix

Fixgit/cmd.py source gitpython-developers/gitpython@9ad28cc4c7+14−0

+    # Match Git's leading transport selector, including an empty helper name.+    re_unsafe_protocol = re.compile(r"([A-Za-z0-9][A-Za-z0-9+.-]*|)::")      unsafe_git_ls_remote_options = [         # This option allows arbitrary command execution in git-ls-remote.

Show 1 hidden lines

@@ -1129,16 +1130,28 @@ def ls_remote(

         self,         *args: Any,         allow_unsafe_options: bool = False,+        allow_unsafe_protocols: bool = False,         **kwargs: Any,     ) -> Union[str, bytes, Tuple[int, Union[str, bytes], str], "Git.AutoInterrupt"]:         """List references in a remote repository.

Show 21 hidden lines

          :param allow_unsafe_options:             Allow unsafe options, like ``--upload-pack`` or ``--exec``.++        :param allow_unsafe_protocols:+            Allow unsafe protocols to be used, like ``ext``. Positional arguments+            and split short-option values are checked.         """         if not allow_unsafe_options:             candidate_options = self._option_candidates(args, kwargs)             Git.check_unsafe_options(options=candidate_options, unsafe_options=self.unsafe_git_ls_remote_options)+        if not allow_unsafe_protocols:+            protocol_args = list(args)+            if kwargs.get("split_single_char_options", True):+                # Split short-option values can become the URL after parsing earlier options.+                protocol_args.extend(value for key, value in kwargs.items() if len(key) == 1)+            for arg in self._unpack_args(protocol_args):+                self.check_unsafe_protocols(arg)         return self._call_process("ls_remote", *args, **kwargs)      @property

Gives ls_remote an allow_unsafe_protocols switch and checks remote URLs against the transport-selector pattern, so an ext:: URL is refused unless the caller opts in.

Patch fingerprints

AI-assisted change 629f1ec5dd9d9926fc7323eb92868441bb054b3fa8af95059c8580a3388d1b2b · Fix 1884fef412d554f716ff865085fa9fc7b3b69339ce85a2b160589e250ea455e7

Advisory references

An AI-written fix for unsafe git options left GitPython's ls_remote accepting unsafe ext:: transport URLs, so applications passing an attacker-chosen remote could still run a helper until 3.2.0.

Provisional finding. Full causal and release verification remains incomplete.

Show full advisory description

GitPython's option guard blocked one external-program option while leaving its equivalent spelling accepted. The repair adds the missing spelling to the blocked options.

What actually happened

AI-assisted change

AI-assisted changegit/cmd.py source gitpython-developers/gitpython@701ce32fe5+5−0

@@ -649,6 +649,11 @@      re_unsafe_protocol = re.compile(r"(.+)::.+") +    unsafe_git_ls_remote_options = [+        # This option allows arbitrary command execution in git-ls-remote.+        "--upload-pack",+    ]+     def __getstate__(self) -> Dict[str, Any]:

Show 2 hidden lines

         return slots_to_dict(self, exclude=self._excluded_)

The new ls-remote option list contains upload-pack without its equivalent exec option.

Security fix

Fixgit/cmd.py source gitpython-developers/gitpython@9ad28cc4c7+14−0

+    # Match Git's leading transport selector, including an empty helper name.+    re_unsafe_protocol = re.compile(r"([A-Za-z0-9][A-Za-z0-9+.-]*|)::")      unsafe_git_ls_remote_options = [         # This option allows arbitrary command execution in git-ls-remote.

Show 1 hidden lines

@@ -1129,16 +1130,28 @@ def ls_remote(

         self,         *args: Any,         allow_unsafe_options: bool = False,+        allow_unsafe_protocols: bool = False,         **kwargs: Any,     ) -> Union[str, bytes, Tuple[int, Union[str, bytes], str], "Git.AutoInterrupt"]:         """List references in a remote repository.

Show 21 hidden lines

          :param allow_unsafe_options:             Allow unsafe options, like ``--upload-pack`` or ``--exec``.++        :param allow_unsafe_protocols:+            Allow unsafe protocols to be used, like ``ext``. Positional arguments+            and split short-option values are checked.         """         if not allow_unsafe_options:             candidate_options = self._option_candidates(args, kwargs)             Git.check_unsafe_options(options=candidate_options, unsafe_options=self.unsafe_git_ls_remote_options)+        if not allow_unsafe_protocols:+            protocol_args = list(args)+            if kwargs.get("split_single_char_options", True):+                # Split short-option values can become the URL after parsing earlier options.+                protocol_args.extend(value for key, value in kwargs.items() if len(key) == 1)+            for arg in self._unpack_args(protocol_args):+                self.check_unsafe_protocols(arg)         return self._call_process("ls_remote", *args, **kwargs)      @property

Gives ls_remote an allow_unsafe_protocols switch and checks remote URLs against the transport-selector pattern, so an ext:: URL is refused unless the caller opts in.