Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-59500
By Stav Salman |
13 August 2026
GitPython kwarg option smuggling bypass enables OS command execution via –upload-pack
GitPython < 3.1.54 allows RCE by bypassing check_unsafe_options via smuggling git options inside single-character kwarg values. Crafted option dictionaries passed to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive can inject --upload-pack to run arbitrary OS commands. Upgrade to 3.1.54+.