Why does GHSA-wv46-xpj8-pw53 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-wv46-xpj8-pw53?

GHSA-wv46-xpj8-pw53 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-wv46-xpj8-pw53?

GHSA-wv46-xpj8-pw53 affects 1 product, including: pip/gitpython:\u003c= 3.1.57.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 8, 2026

GHSA-wv46-xpj8-pw53HighCVSS 8.8Disclosed before NVD

Duplicate Advisory: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

Vendor

GitHub Security Advisories

Published

August 19, 2026

Last Modified

September 8, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-wvpp-8hx9-p66j. This link is maintained to preserve external references.

Original Description

GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.

🎯 Affected products1

pip/gitpython:<= 3.1.57

📋 Description

Duplicate Advisory

Original Description

🎯 Affected products1

🔗 References (4)