Title: fix: block unsafe long-option prefixes (GHSA-2f96-g7mh-g2hx) by Byron · Pull Request #2161 · gitpython-developers/GitPython · GitHub
Open Graph Title: fix: block unsafe long-option prefixes (GHSA-2f96-g7mh-g2hx) by Byron · Pull Request #2161 · gitpython-developers/GitPython
X Title: fix: block unsafe long-option prefixes (GHSA-2f96-g7mh-g2hx) by Byron · Pull Request #2161 · gitpython-developers/GitPython
Description: Tasks basic review Advisory Advisory URL: GHSA-2f96-g7mh-g2hx GHSA: GHSA-2f96-g7mh-g2hx Severity: high (estimated CVSS 8.8, CVE-2026-42215 class) Affected package/version range: PyPI: GitPython <= 3.1.50 (to latest main at the time of report) Patched versions: none Advisory summary Git accepts long-option abbreviations, so exact-match unsafe-option checks could be bypassed (upload_p matching upload-pack). This change keeps unsafe-option checks centralized in Git.check_unsafe_options and rejects canonical option prefixes in addition to exact matches. Changes git/cmd.py: prefix-aware unsafe-option matching against canonicalized option names. test/test_git.py: regression cases for abbreviated dangerous option names. test/test_remote.py: fetch/pull/push regression cases for abbreviated options. test/test_clone.py: clone and clone_from regression cases for abbreviated upload options. Validation stg show c705fe7e... (contains the comment-only fix-up on top of the advisory patch stack) git rev-parse c705fe7e codex review --commit c705fe7e (no blocking findings; comment-only change) Focused pytest execution could not be run here because pytest is not installed in this environment. Created by Codex on behalf of Byron. Byron will review before this is ready to merge.
Open Graph Description: Tasks basic review Advisory Advisory URL: GHSA-2f96-g7mh-g2hx GHSA: GHSA-2f96-g7mh-g2hx Severity: high (estimated CVSS 8.8, CVE-2026-42215 class) Affected package/version range: PyPI: GitPytho...
X Description: Tasks basic review Advisory Advisory URL: GHSA-2f96-g7mh-g2hx GHSA: GHSA-2f96-g7mh-g2hx Severity: high (estimated CVSS 8.8, CVE-2026-42215 class) Affected package/version range: PyPI: GitPytho...
Opengraph URL: https://github.com/gitpython-developers/GitPython/pull/2161
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:a91e672e-c3d3-650e-cc34-9802c4bd10e9 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | 97B6:3E220D:2A2911C:3CB043E:6A56771A |
| html-safe-nonce | 428f98d7c68d0c0a57728aea1504f31cbbedc70e8988596133fb25fc9e5b3db8 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI5N0I2OjNFMjIwRDoyQTI5MTFDOjNDQjA0M0U6NkE1Njc3MUEiLCJ2aXNpdG9yX2lkIjoiOTE1Mjk0MDg0NTYzNjY3OTQ1MCIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | 34f254ab2f46dc813dfd454b0ace6d3f86bbb0ee88543cc07736eecd83b80fa4 |
| hovercard-subject-tag | pull_request:3880673141 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/gitpython-developers/GitPython/pull/2161/files |
| twitter:image | https://avatars.githubusercontent.com/u/63622?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/63622?s=400&v=4 |
| og:image:alt | Tasks basic review Advisory Advisory URL: GHSA-2f96-g7mh-g2hx GHSA: GHSA-2f96-g7mh-g2hx Severity: high (estimated CVSS 8.8, CVE-2026-42215 class) Affected package/version range: PyPI: GitPytho... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 19b5ee9431dcfce15ab4b001d626e4e3a6ba1acb7be814813a52bbebd9a86ef5 |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/gitpython-developers/GitPython git https://github.com/gitpython-developers/GitPython.git |
| octolytics-dimension-user_id | 503709 |
| octolytics-dimension-user_login | gitpython-developers |
| octolytics-dimension-repository_id | 1126087 |
| octolytics-dimension-repository_nwo | gitpython-developers/GitPython |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 1126087 |
| octolytics-dimension-repository_network_root_nwo | gitpython-developers/GitPython |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | afc01ffdb045f4ff81c6122091366ade7b6166b7 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width