An attacker can craft a malicious Git repository containing a .gitmodules file with a submodule name consisting of directory traversal sequences (e.g., ../../../../path/to/target). When a victim clones this repository and initializes the submodules using GitPython, the library creates a new, fully initialized Git repository at the attacker-specified path. This vulnerability affects GitPython versions up to and including 3.1.57. This vulnerability is significant because it mirrors a class of attacks historically patched in the core Git CLI (CVE-2018-11235), and it poses a high risk to automated systems such as CI/CD pipelines, IDEs, and dependency managers that automatically clone and initialize submodules using GitPython.

Attack Chain

1. Attacker creates a malicious Git repository and modifies the .gitmodules file.
2. Attacker sets the [submodule "..."] header name to include traversal sequences (e.g., ../../../../tmp/malicious_dir).
3. Attacker hosts the repository on a platform accessible to the victim.
4. Victim executes a process that uses GitPython to clone the repository (e.g., git.Repo.clone_from()).
5. The application calls sm.update(init=True) or repo.submodules on the cloned repository.
6. GitPython parses the malicious .gitmodules name field without validation.
7. GitPython joins the unsafe name to the base directory path using os.path.join.
8. GitPython executes a command or file operation to create a new Git repository at the traversal-escaped path.

Impact

Successful exploitation allows for the creation of arbitrary directories and Git repositories on the victim's filesystem, limited only by the privileges of the process running GitPython. This can lead to arbitrary file writes, potential overwriting of critical configuration files if the path is carefully chosen, and the introduction of malicious Git hooks or configurations at locations controlled by the attacker. Automated build environments are particularly susceptible due to the high volume of automated submodule initialization.

Recommendation

• Update GitPython to a version where submodule name validation is implemented to prevent directory traversal.
• Restrict the privileges of service accounts executing GitPython clones, ensuring they operate with minimal filesystem permissions.
• Implement pre-processing logic to validate submodule names in .gitmodules files before passing them to GitPython, ensuring they do not contain path traversal characters.
• Audit CI/CD configurations to determine if GitPython is used for recursive submodule initialization and move to hardened environments where possible.

The guard's candidate inspection logic fails to generate candidates for the joined tokens created when split_single_char_options is disabled. Consequently, the guard inspects the single-character key (e.g., '-n'), finds it safe, and passes. The subsequent transform_kwarg logic then assembles a joined token (e.g., -nutouch <cmd>;git-upload-pack) which the git binary parses as the --upload-pack flag. This results in the execution of the injected command with the privileges of the host process.

Attack Chain

1. Attacker identifies an application endpoint that forwards user-controlled dictionaries as keyword arguments to a GitPython method (e.g., Repo.clone_from(url, path, **kwargs)).
2. Attacker provides a payload dict: {'split_single_char_options': False, 'n': 'utouch /tmp/ACE;git-upload-pack'}.
3. GitPython internal _option_candidates function processes the kwargs and identifies only ['-n'] as a candidate.
4. check_unsafe_options compares ['-n'] against the safety denylist.
5. The denylist check passes because ['-n'] is not considered an unsafe option, failing to see the smuggled command within the value.
6. The transform_kwarg function merges the key and value into a single CLI token: -nutouch /tmp/ACE;git-upload-pack.
7. The final argument list is passed to the underlying git subprocess.
8. Git parses the joined flag as --upload-pack=utouch /tmp/ACE;git-upload-pack, leading to arbitrary command execution.

Impact

Successful exploitation allows for arbitrary OS command execution as the user running the GitPython process. This vulnerability affects any application utilizing GitPython's guarded methods while exposing kwargs to user input. The impact is significant as it facilitates unauthorized code execution and potential lateral movement or system compromise within environments hosting Git-integrated automation or CI/CD pipelines.

Recommendation

Prioritize upgrading GitPython to a version where _option_candidates includes value-derived candidates regardless of split_single_char_options. If an immediate patch is unavailable, audit all code paths that forward user-supplied dictionaries as **kwargs to GitPython methods. Implement strict allowlisting for all keyword arguments instead of relying on the library's default guards.