How AI contributed: Incomplete remediationPublished Aug 3, 2026 in 
gitpython-developers/gitpythonAll 8 findings in this repository
Target: gitpython-developers/GitPython Tested: HEAD 07e80555 (2026-07-25), latest release 3.1.55, git version 2.50.1 Summary Repo.archive() does call the option guard, so this is not a missing-guard report. The guard is present and working; the denylist it consults is incomplete. The comment on --output states the protected class in the project's own words: an option that lets the caller name a filesystem path is unsafe. --output is blocked because it *writes* to a caller-chosen path. git archive also accepts --add-file=<path> and --add-virtual-file=<path:content> (both present in current git; verified against git version 2.50.1). --add-file *reads* a caller-chosen path — including an absolute path outside the repository — and places the bytes into the archive the caller receives. Neither option is in the list, and no other layer references them: Net effect: the guard blocks arbitrary file write at this sink while permitting arbitrary file read at the same sink. Reachability proof (verified at the sink) poc/poc_addfile.py at HEAD 07e80555. The PoC creates its own out-of-tree canary, so it runs from a clean machine: The three blocked lines are the control: they prove the guard is active on this call path, so the fourth result is a gap in list membership rather than a guard that never ran. Minimal reproduction: The canary is untracked and lives outside the repository; its contents are recovered from the returned archive and asserted byte-for-byte against the on-disk file. The option is rendered by transform_kwargs into --add-file=<path> and reaches git archive unmodified. Direct precedent GHSA-6p8h-3wgx-97gf (High, published 2026-07-22) is the same defect on the sibling list: *"Incomplete unsafe_git_clone_options denylist omits --template"* — an option absent from one of these denylists, reachable under the same caller-controlled-options precondition, accepted and fixed by adding it. git log shows the archive list itself has already been extended reactively once, in 701ce32f (*fix: Guard unsafe git command options*, GHSA-956x-8gvw-wg5v), and the --template omission was then fixed separately in ffcb5359. --add-virtual-file is the same gap pointing the other way --add-virtual-file=<path:content> lets the caller inject attacker-chosen content under an attacker-chosen name into an archive that downstream consumers will reasonably treat as repository-derived. Suggested remediation 1. Preferred — allowlist. Repo.archive() has a small legitimate option surface (format, prefix, worktree_attributes, remote, compression level, plus paths). Accepting those and rejecting the rest means a future git release cannot add another path-taking option that silently reopens this. 2. Minimum — extend the list with --add-file and --add-virtual-file, and make the membership rule *"the option takes a filesystem path or URL"* rather than *"the option executes a command"*. The existing comment on --output already implies that rule; applying it consistently is what closes the class instead of this instance. Scope limits · Impact is arbitrary file read at the privileges of the process. Not code execution — I make no such claim here. · It requires the embedding application to forward caller-influenced kwargs into Repo.archive(). That is the identical precondition to --output, --exec and --template, all of which this project has treated as reportable. Disclosure Reported privately via GitHub private vulnerability reporting. Happy to test a candidate patch against the PoC. No public disclosure until you have shipped a fix and are ready. --- Addendum (2026-07-25) — related observation on the same membership question, filed here rather than separately While auditing the archive denylist, the same class of gap was identified in unsafe_git_clone_options. A second advisory is not being requested, as the issue is lower severity and should inform the fix for the issue above rather than require separate triage. Recording it here to provide the complete picture in one place. Repo._clone() treats a URL's protocol as a security boundary and applies check_unsafe_protocols() to exactly one input: git clone accepts a second URL via --bundle-uri=<uri>, which git dereferences before the main transport runs. That option is absent from unsafe_git_clone_options, so the option guard passes it, and check_unsafe_protocols() never inspects it. A caller-influenced value therefore drives an outbound request from the host: Confirmed against a local listener — the request leaves the process: file:///path is likewise accepted without error. Note this is not a tokenisation bypass: multi_options is shlex.split before the check (per c9a26789 / GHSA-x2qx-6953-8485), so the fully-split --bundle-uri=... token is checked and legitimately passes because the option is not on the list. Why it belongs with this report: both are the *membership* question rather than the matching logic — is the set of blocked options complete, and does the protocol guard inspect every URL git will dereference? The structural remediation proposed above covers both if extended slightly: prefer an allowlist per command, and route every URL-bearing option through check_unsafe_protocols(), not only the positional URL. Adding --bundle-uri to unsafe_git_clone_options would be the minimal fix.
An AI-written hardening change added option denylists to GitPython's Repo.archive() and clone helpers, but the archive list blocked only --exec, --output and -o, and the clone list omitted --bundle-uri. Keyword options passed to archive could therefore still add --add-file, which copies a caller-chosen path, including absolute paths outside the repository, into the archive the caller receives, or --add-virtual-file, which injects chosen content; a clone could still be pointed at an extra bundle URI. The repair, first released in 3.1.57, adds all three options to the denylists.
Case facts
ChatGPT/CodexOnly the highlighted steps are this advisory. The first step is the earlier flaw the AI tried, and failed, to close.
Original flaw
Earlier flawSink: GitPython Repo.archive() keyword forwarding to git archive, and clone keyword forwarding to git clone
Originally written by Sebastian Thiel
This advisoryCVE-2026-73619 (GHSA-539M-9XH6-Q6RR)
AI tried to fix this
The AI-assisted change was a real security patch, but it left the same advisory reachable.
Missed: Omitted --add-file and --add-virtual-file from the archive denylist and --bundle-uri from the clone denylist.
Incomplete AI-assisted fix · ChatGPT/Codex
Fixed again
This is the patch that actually stops the same attack path.
AI-assisted fix: ChatGPT/Codex · GPT 5.6
--- a/git/repo/base.py+++ b/git/repo/base.py@@ -161,6 +161,20 @@ class Repo: https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---configltkeygtltvaluegt """ + unsafe_git_archive_options = [+ # Allows arbitrary command execution through the remote git-upload-archive command.+ "--exec",+ # Writes output to a caller-controlled filesystem path.+ "--output",+ "-o",+ ]++ unsafe_git_revision_options = [+ # This option allows output to be written to arbitrary files before revision parsing.+ "--output",+ "-o",+ ]+ # Invariants config_level: ConfigLevels_Tup = ("system", "user", "global", "repository") """Represents the configuration level of a configuration file."""@@ -775,6 +789,7 @@ class Repo: self, rev: Union[str, Commit, "SymbolicReference", None] = None, paths: Union[PathLike, Sequence[PathLike]] = "",+ allow_unsafe_options: bool = False, **kwargs: Any, ) -> Iterator[Commit]: """An iterator of :class:`~git.objects.commit.Commit` objects representing the@@ -792,6 +807,9 @@ class Repo: Arguments to be passed to :manpage:`git-rev-list(1)`. Common ones are ``max_count`` and ``skip``. + :param allow_unsafe_options:+ Allow unsafe options in the revision argument, like ``--output``.+ :note: To receive only commits between two named revisions, use the ``"revA...revB"`` revision specifier.@@ -802,7 +820,18 @@ class Repo: if rev is None: rev = self.head.commit - return Commit.iter_items(self, rev, paths, **kwargs)+ if not allow_unsafe_options:+ Git.check_unsafe_options(+ options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options+ )++ return Commit.iter_items(+ self,+ rev,+ paths,+ allow_unsafe_options=allow_unsafe_options,+ **kwargs,+ ) def merge_base(self, *rev: TBD, **kwargs: Any) -> List[Commit]: R"""Find the closest common ancestor for the given revision@@ -1079,7 +1108,9 @@ class Repo: ) return active_branch - def blame_incremental(self, rev: str | HEAD | None, file: str, **kwargs: Any) -> Iterator["BlameEntry"]:+ def blame_incremental(+ self, rev: str | HEAD | None, file: str, allow_unsafe_options: bool = False, **kwargs: Any+ ) -> Iterator["BlameEntry"]: """Iterator for blame information for the given file at the given revision. Unlike :meth:`blame`, this does not return the actual file's contents, only a@@ -1090,6 +1121,9 @@ class Repo: uncommitted changes. Otherwise, anything successfully parsed by :manpage:`git-rev-parse(1)` is a valid option. + :param allow_unsafe_options:+ Allow unsafe options in revision argument, like ``--output``.+ :return: Lazy iterator of :class:`BlameEntry` tuples, where the commit indicates the commit to blame for the line, and range indicates a span of line numbers in@@ -1098,6 +1132,10 @@ class Repo: If you combine all line number ranges outputted by this command, you should get a continuous range spanning all line numbers in the file. """+ if not allow_unsafe_options:+ Git.check_unsafe_options(+ options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options+ ) data: bytes = self.git.blame(rev, "--", file, p=True, incremental=True, stdout_as_string=False, **kwargs) commits: Dict[bytes, Commit] = {}@@ -1176,7 +1214,8 @@ class Repo: rev: Union[str, HEAD, None], file: str, incremental: bool = False,- rev_opts: Optional[List[str]] = None,+ rev_opts: Optional[Sequence[str]] = None,+ allow_unsafe_options: bool = False, **kwargs: Any, ) -> List[List[Commit | List[str | bytes] | None]] | Iterator[BlameEntry] | None: """The blame information for the given file at the given revision.@@ -1186,6 +1225,9 @@ class Repo: uncommitted changes. Otherwise, anything successfully parsed by :manpage:`git-rev-parse(1)` is a valid option. + :param allow_unsafe_options:+ Allow unsafe options in revision argument, like ``--output``.+ :return: list: [git.Commit, list: [<line>]] @@ -1195,9 +1237,14 @@ class Repo: appearance. """ if incremental:- return self.blame_incremental(rev, file, **kwargs)- rev_opts = rev_opts or []- data: bytes = self.git.blame(rev, *rev_opts, "--", file, p=True, stdout_as_string=False, **kwargs)--- a/test/test_clone.py+++ b/test/test_clone.py@@ -117,11 +117,13 @@ class TestClone(TestBase): tmp_file = tmp_dir / "pwn" unsafe_options = [ f"--upload-pack='touch {tmp_file}'",+ f"--upl='touch {tmp_file}'", f"-u 'touch {tmp_file}'", f"-utouch {tmp_file}; false", f"-futouch${{IFS}}{tmp_file}; false", f"-qutouch${{IFS}}{tmp_file}; false", "--config=protocol.ext.allow=always",+ "--conf=protocol.ext.allow=always", "-c protocol.ext.allow=always", "-cprotocol.ext.allow=always", "-vcprotocol.ext.allow=always",@@ -134,8 +136,10 @@ class TestClone(TestBase): unsafe_options = [ {"upload-pack": f"touch {tmp_file}"}, {"upload_pack": f"touch {tmp_file}"},+ {"upl": f"touch {tmp_file}"}, {"u": f"touch {tmp_file}"}, {"config": "protocol.ext.allow=always"},+ {"conf": "protocol.ext.allow=always"}, {"c": "protocol.ext.allow=always"}, ] for unsafe_option in unsafe_options:--- a/test/test_repo.py+++ b/test/test_repo.py@@ -37,6 +37,8 @@ from git import ( Submodule, Tree, )+from git.exc import UnsafeOptionError+from git.exc import UnsafeProtocolError from git.exc import BadObject from git.repo.fun import touch from git.util import bin_to_hex, cwd, cygpath, join_path_native, rmfile, rmtree@@ -422,6 +424,54 @@ class TestRepo(TestBase): assert stream.tell() os.remove(stream.name) # Do it this way so we can inspect the file on failure. + def test_archive_rejects_unsafe_options(self):+ with tempfile.TemporaryDirectory() as tdir:+ output_marker = osp.join(tdir, "pwn")+ with self.assertRaises(UnsafeOptionError):+ self.rorepo.archive(io.BytesIO(), "0.1.6", exec=f"touch {output_marker}")+ assert not osp.exists(output_marker)+ with self.assertRaises(UnsafeOptionError):+ self.rorepo.archive(io.BytesIO(), "0.1.6", output=output_marker)+ assert not osp.exists(output_marker)++ def test_archive_rejects_unsafe_remote_protocol(self):+ with tempfile.TemporaryDirectory() as tdir:+ output_marker = osp.join(tdir, "pwn")+ with self.assertRaises(UnsafeProtocolError):+ self.rorepo.archive(io.BytesIO(), "HEAD", remote=f"ext::sh -c touch% {output_marker}")+ assert not osp.exists(output_marker)++ def test_archive_preserves_positional_allow_unsafe_options(self):+ with mock.patch.object(Git, "_call_process") as git:+ self.rorepo.archive(io.BytesIO(), "HEAD", None, True, exec="git-upload-archive")+ git.assert_called_once()++ def test_archive_accepts_stringifiable_remote(self):+ class StringifiableRemote:+ def __str__(self):+ return "origin"++ with mock.patch.object(Git, "_call_process") as git:+ self.rorepo.archive(io.BytesIO(), "HEAD", remote=StringifiableRemote())+ git.assert_called_once()++ def test_archive_rejects_unsafe_falsey_remote_protocol(self):+ class FalseyRemote:+ def __bool__(self):+ return False++ def __str__(self):+ return "ext::sh -c true"++ with self.assertRaises(UnsafeProtocolError):+ self.rorepo.archive(io.BytesIO(), "HEAD", remote=FalseyRemote())++ def test_iter_commits_rejects_unsafe_revision(self):+ with tempfile.TemporaryDirectory() as tdir:+ target = osp.join(tdir, "pwn")+ with self.assertRaises(UnsafeOptionError):+ list(self.rorepo.iter_commits(f"--output={target}", max_count=1))+ @mock.patch.object(Git, "_call_process") def test_should_display_blame_information(self, git): git.return_value = fixture("blame")@@ -471,6 +521,27 @@ class TestRepo(TestBase): assert c, "Should have executed at least one blame command" assert nml, "There should at least be one blame commit that contains multiple lines" + def test_blame_rejects_unsafe_revision(self):+ with tempfile.TemporaryDirectory() as tdir:+ output_marker = osp.join(tdir, "pwn")+ with self.assertRaises(UnsafeOptionError):+ self.rorepo.blame(f"--output={output_marker}", "README.md")+ assert not osp.exists(output_marker)++ def test_blame_rejects_unsafe_options(self):+ with tempfile.TemporaryDirectory() as tdir:+ output_marker = osp.join(tdir, "pwn")+ with self.assertRaises(UnsafeOptionError):+ self.rorepo.blame("HEAD", "README.md", output=output_marker)+ assert not osp.exists(output_marker)++ def test_blame_rejects_unsafe_rev_opts(self):+ with tempfile.TemporaryDirectory() as tdir:+ output_marker = osp.join(tdir, "pwn")+ with self.assertRaises(UnsafeOptionError):+ self.rorepo.blame("HEAD", "README.md", rev_opts=(f"--output={output_marker}",))+ assert not osp.exists(output_marker)+ @mock.patch.object(Git, "_call_process") def test_blame_incremental(self, git): # Loop over two fixtures, create a test fixture for 2.11.1+ syntax.--- a/git/repo/base.py+++ b/git/repo/base.py@@ -151,6 +151,8 @@ class Repo: "-c", # Can install hooks that execute during clone: "--template",+ # Fetches from a caller-controlled URL:+ "--bundle-uri", ] """Options to :manpage:`git-clone(1)` that allow arbitrary commands to be executed. @@ -172,6 +174,10 @@ class Repo: # Writes output to a caller-controlled filesystem path. "--output", "-o",+ # Reads from a caller-controlled filesystem path:+ "--add-file",+ # Injects a caller-controlled path and contents:+ "--add-virtual-file", ] unsafe_git_revision_options = [--- a/test/test_clone.py+++ b/test/test_clone.py@@ -132,6 +132,7 @@ class TestClone(TestBase): "-cprotocol.ext.allow=always", "-vcprotocol.ext.allow=always", f"--template={tmp_dir}",+ f"--bundle-uri=file://{tmp_dir}", ] for unsafe_option in unsafe_options: with self.assertRaises(UnsafeOptionError):@@ -147,6 +148,7 @@ class TestClone(TestBase): {"conf": "protocol.ext.allow=always"}, {"c": "protocol.ext.allow=always"}, {"template": tmp_dir},+ {"bundle_uri": f"file://{tmp_dir}"}, ] for unsafe_option in unsafe_options: with self.assertRaises(UnsafeOptionError):--- a/test/test_repo.py+++ b/test/test_repo.py@@ -433,6 +433,10 @@ class TestRepo(TestBase): with self.assertRaises(UnsafeOptionError): self.rorepo.archive(io.BytesIO(), "0.1.6", output=output_marker) assert not osp.exists(output_marker)+ with self.assertRaises(UnsafeOptionError):+ self.rorepo.archive(io.BytesIO(), "0.1.6", add_file=output_marker)+ with self.assertRaises(UnsafeOptionError):+ self.rorepo.archive(io.BytesIO(), "0.1.6", add_virtual_file="file:content") def test_archive_rejects_unsafe_remote_protocol(self): with tempfile.TemporaryDirectory() as tdir:AI-assisted change be1cbc3cdf48766f7b416dc4b5b3fa547a9c58d8287b570f9f9d3abf76b75cf7 · Fix 7d34a1b90568393c7af7fe8df799ccb1c264aa679743dc8c7e272d328601fbde