An AI-written hardening change checked split short-option values but not the joined form, so attacker-controlled keyword options to GitPython's clone could still smuggle in git's upload-pack option and run a command.

How AI contributed: Incomplete remediationPublished Aug 7, 2026 in gitpython-developers/gitpythonAll 8 findings in this repository

What actually happened

GitPython's clone helpers refuse unsafe options such as upload-pack unless the caller opts in, but the check looks at the option names a caller passes rather than the arguments that reach git. With single-character option splitting turned off, a one-letter keyword option and its value are joined into one token, and git reads that token as a cluster of short switches that can include -u, its short form of upload-pack, so attacker-controlled keyword options to clone can still run a command. Releases before 3.1.30 have no such protection at all, and the protection added in 3.1.30 and the keyword check added in 3.1.32 never inspect the joined form. An AI-written change in 3.1.54 added a check on split short-option values that still missed the joined token; the clone-path repair first shipped in 3.1.58.

Case facts

CVE ID: CVE-2026-76220
GHSA ID: GHSA-WVPP-8HX9-P66J
Published: Aug 7, 2026
Severity: HIGH
Language: Python
AI tool: ChatGPT/Codex
AI role: Incomplete remediation
Vulnerable release: <= 3.1.57
Fixed release: 3.1.58

CWE-88

Advisory source

Only the highlighted steps are this advisory. The first step is the earlier flaw the AI tried, and failed, to close.

Original flaw

Earlier flaw

GitPython's clone unsafe-option protection never inspected the joined token that a one-letter keyword option and its value form when option splitting is off.

Sink: GitPython clone unsafe-option checks in Repo._clone

Originally written by Santos Gallegos

e6108c7997

This advisoryCVE-2026-76220 (GHSA-WVPP-8HX9-P66J)

AI tried to fix this

Added dash-prefixed values of split one-letter options to the unsafe-option candidates.

The AI-assisted change was a real security patch, but it left the same advisory reachable.

Missed: Left the joined token emitted when splitting is off out of the candidates.

Incomplete AI-assisted fix · ChatGPT/Codex

e8d0fbf774

git/cmd.py test/test_git.py

Fixed again

Added the exact joined token to the candidates checked before Git runs.

This is the patch that actually stops the same attack path.

AI-assisted fix: ChatGPT/Codex · Byron

96a888f4d7

git/cmd.py test/test_git.py

AI-assisted change

AI-assisted changegit/cmd.py source gitpython-developers/gitpython@e8d0fbf774+7−0

@@ -1039,11 +1039,18 @@ def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[s             option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith("-")         ]         if kwargs:+            split_single_char_options = kwargs.get("split_single_char_options", True)             for key, value in kwargs.items():                 values = value if isinstance(value, (list, tuple)) else (value,)                 if any(value is True or (value is not False and value is not None) for value in values):                     key = str(key)                     options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}")+                    if len(key) == 1 and split_single_char_options:+                        options.extend(+                            str(value)+                            for value in values

Show 5 hidden lines

+                            if value is not True and value not in (False, None) and str(value).startswith("-")+                        )         return options      AutoInterrupt: TypeAlias = _AutoInterrupt

Adds dash-prefixed values from one-letter keyword options to the candidate list only when splitting is enabled, leaving the joined short-option token that Git parses as clustered switches out of the candidate list when splitting stays disabled.

AI-assisted changetest/test_git.py source gitpython-developers/gitpython@e8d0fbf774+17−0

@@ -214,6 +214,23 @@ def test_option_candidates_ignore_untransformed_kwargs(self):          self.assertEqual(options, ["--max-count"])

Show 5 hidden lines

+    def test_option_candidates_include_split_single_char_option_values(self):+        cases = [+            ({"n": "--upload-pack=helper"}, ["-n", "--upload-pack=helper"], ["--upload-pack"]),+            ({"g": ("safe", "--out=target")}, ["-g", "--out=target"], ["--output"]),+        ]

++        for kwargs, candidates, unsafe_options in cases:+            self.assertEqual(Git._option_candidates(kwargs=kwargs), candidates)+            with self.assertRaises(UnsafeOptionError):+                Git.check_unsafe_options(options=candidates, unsafe_options=unsafe_options)++        self.assertEqual(self.git.transform_kwargs(n="--upload-pack=helper"), ["-n", "--upload-pack=helper"])++        unsplit_kwargs = {"n": "--upload-pack=helper", "split_single_char_options": False}+        self.assertEqual(self.git.transform_kwargs(**unsplit_kwargs), ["-n--upload-pack=helper"])+        self.assertEqual(Git._option_candidates(kwargs=unsplit_kwargs), ["-n"])+

Show 3 hidden lines

     _shell_cases = (         # value_in_call, value_from_class, expected_popen_arg         (None, False, False),

Asserts that split one-character option values appear as candidates and are rejected when checked against forbidden option lists, while recording that unsplit values collapse into a single joined token whose candidate list holds only the bare flag.

Security fix

Fixgit/cmd.py source gitpython-developers/gitpython@96a888f4d7+10−2

@@ -1044,13 +1044,21 @@ def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[s                 values = value if isinstance(value, (list, tuple)) else (value,)                 if any(value is True or (value is not False and value is not None) for value in values):                     key = str(key)-                    options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}")-                    if len(key) == 1 and split_single_char_options:+                    if len(key) != 1:+                        options.append(f"--{dashify(key)}")+                    elif split_single_char_options:+                        options.append(f"-{key}")                         options.extend(                             str(value)

Show 12 hidden lines

                             for value in values                             if value is not True and value not in (False, None) and str(value).startswith("-")                         )+                    else:+                        options.extend(+                            f"-{key}" if value is True else f"-{key}{value}"+                            for value in values+                            if value is True or (value is not False and value is not None)+                        )         return options      AutoInterrupt: TypeAlias = _AutoInterrupt

Includes the exact joined token emitted for each unsplit one-character flag among the candidates, so values glued onto a short option become visible to the same validation that guards command execution.

Fixtest/test_git.py source gitpython-developers/gitpython@96a888f4d7+9−1

@@ -230,7 +230,15 @@ def test_option_candidates_include_split_single_char_option_values(self):          unsplit_kwargs = {"n": "--upload-pack=helper", "split_single_char_options": False}         self.assertEqual(self.git.transform_kwargs(**unsplit_kwargs), ["-n--upload-pack=helper"])-        self.assertEqual(Git._option_candidates(kwargs=unsplit_kwargs), ["-n"])+        self.assertEqual(Git._option_candidates(kwargs=unsplit_kwargs), ["-n--upload-pack=helper"])++    def test_option_candidates_include_joined_single_char_option_values(self):+        kwargs = {"n": "uhelper", "split_single_char_options": False}+        candidates = Git._option_candidates(kwargs=kwargs)++        self.assertEqual(candidates, ["-nuhelper"])+        with self.assertRaises(UnsafeOptionError):+            Git.check_unsafe_options(options=candidates, unsafe_options=["-u"])      _shell_cases = (         # value_in_call, value_from_class, expected_popen_arg

Updates the unsplit case to expect the joined token among the candidates and pins rejection of a value glued onto a one-character flag when its letters expose a forbidden clustered short option.

Patch fingerprints

AI-assisted change 3f95d3563cdce315c4cafde343db5289b955dfa2deb7a21c85a5a6927b24e47b · Fix d1ba267124cdd3725655b996f15366da87de66fbfa9bca61ce917f70d13f57d8

Advisory references

An AI-written hardening change checked split short-option values but not the joined form, so attacker-controlled keyword options to GitPython's clone could still smuggle in git's upload-pack option and run a command.

What actually happened

AI-assisted change

AI-assisted changegit/cmd.py source gitpython-developers/gitpython@e8d0fbf774+7−0

@@ -1039,11 +1039,18 @@ def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[s             option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith("-")         ]         if kwargs:+            split_single_char_options = kwargs.get("split_single_char_options", True)             for key, value in kwargs.items():                 values = value if isinstance(value, (list, tuple)) else (value,)                 if any(value is True or (value is not False and value is not None) for value in values):                     key = str(key)                     options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}")+                    if len(key) == 1 and split_single_char_options:+                        options.extend(+                            str(value)+                            for value in values

Show 5 hidden lines

+                            if value is not True and value not in (False, None) and str(value).startswith("-")+                        )         return options      AutoInterrupt: TypeAlias = _AutoInterrupt

AI-assisted changetest/test_git.py source gitpython-developers/gitpython@e8d0fbf774+17−0

@@ -214,6 +214,23 @@ def test_option_candidates_ignore_untransformed_kwargs(self):          self.assertEqual(options, ["--max-count"])

Show 5 hidden lines

+    def test_option_candidates_include_split_single_char_option_values(self):+        cases = [+            ({"n": "--upload-pack=helper"}, ["-n", "--upload-pack=helper"], ["--upload-pack"]),+            ({"g": ("safe", "--out=target")}, ["-g", "--out=target"], ["--output"]),+        ]

++        for kwargs, candidates, unsafe_options in cases:+            self.assertEqual(Git._option_candidates(kwargs=kwargs), candidates)+            with self.assertRaises(UnsafeOptionError):+                Git.check_unsafe_options(options=candidates, unsafe_options=unsafe_options)++        self.assertEqual(self.git.transform_kwargs(n="--upload-pack=helper"), ["-n", "--upload-pack=helper"])++        unsplit_kwargs = {"n": "--upload-pack=helper", "split_single_char_options": False}+        self.assertEqual(self.git.transform_kwargs(**unsplit_kwargs), ["-n--upload-pack=helper"])+        self.assertEqual(Git._option_candidates(kwargs=unsplit_kwargs), ["-n"])+

Show 3 hidden lines

     _shell_cases = (         # value_in_call, value_from_class, expected_popen_arg         (None, False, False),

Security fix

Fixgit/cmd.py source gitpython-developers/gitpython@96a888f4d7+10−2

@@ -1044,13 +1044,21 @@ def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[s                 values = value if isinstance(value, (list, tuple)) else (value,)                 if any(value is True or (value is not False and value is not None) for value in values):                     key = str(key)-                    options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}")-                    if len(key) == 1 and split_single_char_options:+                    if len(key) != 1:+                        options.append(f"--{dashify(key)}")+                    elif split_single_char_options:+                        options.append(f"-{key}")                         options.extend(                             str(value)

Show 12 hidden lines

                             for value in values                             if value is not True and value not in (False, None) and str(value).startswith("-")                         )+                    else:+                        options.extend(+                            f"-{key}" if value is True else f"-{key}{value}"+                            for value in values+                            if value is True or (value is not False and value is not None)+                        )         return options      AutoInterrupt: TypeAlias = _AutoInterrupt

Fixtest/test_git.py source gitpython-developers/gitpython@96a888f4d7+9−1

@@ -230,7 +230,15 @@ def test_option_candidates_include_split_single_char_option_values(self):          unsplit_kwargs = {"n": "--upload-pack=helper", "split_single_char_options": False}         self.assertEqual(self.git.transform_kwargs(**unsplit_kwargs), ["-n--upload-pack=helper"])-        self.assertEqual(Git._option_candidates(kwargs=unsplit_kwargs), ["-n"])+        self.assertEqual(Git._option_candidates(kwargs=unsplit_kwargs), ["-n--upload-pack=helper"])++    def test_option_candidates_include_joined_single_char_option_values(self):+        kwargs = {"n": "uhelper", "split_single_char_options": False}+        candidates = Git._option_candidates(kwargs=kwargs)++        self.assertEqual(candidates, ["-nuhelper"])+        with self.assertRaises(UnsafeOptionError):+            Git.check_unsafe_options(options=candidates, unsafe_options=["-u"])      _shell_cases = (         # value_in_call, value_from_class, expected_popen_arg

Updates the unsplit case to expect the joined token among the candidates and pins rejection of a value glued onto a one-character flag when its letters expose a forbidden clustered short option.