GHSA-2F96-G7MH-G2HX: Root-Cause Fix for GitPython Option Validation Bypass

Vulnerability

GHSA-2F96-G7MH-G2HX describes a command-injection bypass in GitPython's unsafe option filtering. The original validation logic compared canonicalized option names for exact equality, but Git accepts more than exact spellings: abbreviated long options such as upload_p for --upload-pack, and single-dash short-option forms with attached values or clustered flags such as -utouch ..., -futouch ..., and -cprotocol.ext.allow=always. Because the filter did not model those parser behaviors, attacker-controlled inputs could evade the denylist and reach dangerous Git options that execute helper commands or alter transport behavior.

The patch sources show the vulnerable path in git/cmd.py and the clone call site in git/repo/base.py, with regression coverage added in tests for clone, generic option checking, and remote operations. See the pull request and commit for the concrete changes: PR #2161, commit 5680608.

def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:
    canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options}
    unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option))
    if unsafe_option is not None:
        raise UnsafeOptionError(...)

That exact-match approach was insufficient for Git's accepted abbreviations and short-option token forms.

Patch

The patch replaces simplistic equality checks with parser-aware matching logic in git/cmd.py. It introduces:

• _option_token() to isolate the option-bearing token before = or whitespace splitting.
• _is_long_option() to distinguish long-option semantics from short-option semantics, including a mode where bare multi-character names are treated as normalized keyword-style long options.
• _matches_unsafe_short_option() to detect unsafe short options inside single-dash tokens, including after clusterable flags.
• An updated check_unsafe_options(..., bare_options_are_long=True) that rejects exact matches, long-option prefix abbreviations, and embedded unsafe short options.

@classmethod
def check_unsafe_options(
    cls, options: List[str], unsafe_options: List[str], bare_options_are_long: bool = True
) -> None:
    canonical_unsafe_options = [
        (cls._canonicalize_option_name(option), option, cls._is_long_option(option)) for option in unsafe_options
    ]
    option_token = cls._option_token(option)
    if not bare_options_are_long and not option_token.startswith("-"):
        continue
    canonical_option = cls._canonicalize_option_name(option)
    option_is_long = cls._is_long_option(option, bare_options_are_long=bare_options_are_long)
    for (canonical_unsafe_option, unsafe_option, unsafe_option_is_long) in canonical_unsafe_options:
        if (
            canonical_option == canonical_unsafe_option
            or (
                option_is_long
                and unsafe_option_is_long
                and canonical_unsafe_option.startswith(canonical_option)
            )
            or cls._matches_unsafe_short_option(option, canonical_unsafe_option, unsafe_option_is_long)
        ):
            raise UnsafeOptionError(...)

The clone path in git/repo/base.py now calls the checker with bare_options_are_long=False, which is important because clone argument lists can contain positional values. This prevents false positives such as ["--origin", "upload"], where upload is a value, not an abbreviated unsafe option.

The tests added in the PR and the fixing commit verify rejection of abbreviated long options like upload_p, receive_p, and exe; rejection of joined short-option payloads like -utouch /tmp/pwn and -cprotocol.ext.allow=always; and preservation of safe attached values such as -oupstream and -bcurrent.

Review

Pros

• The fix addresses the actual parser mismatch at the root of the bypass: Git accepts long-option abbreviations and certain short-option clusters, so the filter now checks those forms explicitly.
• The new bare_options_are_long mode is a strong design choice. It separates normalized keyword-like inputs from tokenized CLI argument lists, reducing false positives in clone and similar call sites.
• The short-option logic is intentionally constrained by a clusterable_flags set, which helps distinguish unsafe embedded options from safe attached values like -oupstream.
• Regression coverage is materially improved. The tests exercise both exploit forms and non-exploit edge cases, including abbreviated long names, joined short options, clustered flags, and positional values.
• The updated docstring in the commit explains the parsing model and security rationale clearly, which should help future maintainers avoid reintroducing the same class of bug.

Cons

• The implementation still relies on a handcrafted approximation of Git option parsing rather than delegating to Git or using a formally specified parser. That means long-term correctness depends on maintaining parity with Git semantics.
• The clusterable_flags allowlist is security-sensitive. If Git's cluster behavior differs across commands or evolves, this logic may become incomplete or overly strict.
• The patch is denylist-based. It improves the denylist substantially, but dangerous behavior remains gated by recognizing all relevant spellings of unsafe options rather than eliminating the dangerous option surface entirely.
• The snippets do not show broader architectural hardening such as avoiding shell-sensitive execution paths altogether; this patch is focused on validation correctness.

Verdict

Root-cause.

This patch fixes the underlying validation flaw rather than merely blocking one payload. The original bug was a semantic gap between GitPython's exact-match filtering and Git's accepted option spellings. The new logic closes that gap for the reported bypass classes: abbreviated long options, joined unsafe short options, and clustered short-option forms, while also correcting context-sensitive handling of bare tokens in clone argument lists. Based on the provided sources, this is a source-grounded and technically sound remediation for GHSA-2F96-G7MH-G2HX, with good regression coverage in PR #2161 and commit 5680608.