GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers ca…

GitPython versions before 3.1.51 contain a vulnerability in their command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by supplying abbreviated option names such as 'upload_p' instead of 'upload_pack', which git internally resolves to the full dangerous option and executes arbitrary commands. This represents an incomplete fix or oversight in the security controls designed to prevent unsafe git option injection. The vulnerability allows remote or local attackers who can influence git command arguments to execute arbitrary commands on the system. Users and organizations relying on GitPython for git operations in automated pipelines, CI/CD systems, or web applications are at risk. The fix is available in GitPython 3.1.51, and users are strongly advised to upgrade immediately. The issue has been documented by both the GitPython developers via a GitHub Security Advisory and independently by VulnCheck.