GHSA-rpm5/GHSA-x2qx - GitPython command injection

rg -n "GitPython|from git import Repo|import git|Repo\.clone_from|Repo\.clone\(|\.fetch\(|\.pull\(|\.push\(|multi_options|clone_multi_options|upload_pack|receive_pack|allow_unsafe" .
python -m pip show GitPython
pip freeze | rg '^GitPython=='
rg -n "extra.*git|git.*options|clone.*options|repo.*import|repository.*sync|webhook.*clone|workflow.*clone" .

Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating GitPython command injection advisories
GHSA-rpm5-65cw-6hj4 and GHSA-x2qx-6953-8485. Produce exactly one output:

- A reviewer-ready PR/change request that upgrades GitPython, removes unsafe
  option pass-through, adds regression coverage, and documents operator cleanup,
  or
- TRIAGE.md if this repository does not own an affected GitPython runtime or
  safe patch path.

## Rules

- Scope only GHSA-rpm5-65cw-6hj4 and GHSA-x2qx-6953-8485.
- Treat SSH keys, deploy keys, package tokens, cloud credentials, source code,
  repo URLs, and worker environment values as sensitive.
- Do not execute exploit payloads, helper commands, custom hooks, reverse
  shells, or attacker-controlled Git options.
- Do not keep a free-form "extra Git options" feature for untrusted callers.
- Do not auto-merge.

## Steps

1. Inventory every GitPython dependency controlled by this repository:
   requirements files, pyproject files, lockfiles, constraints, Dockerfiles,
   base images, CI images, worker images, SBOMs, vendored code, and deployment
   manifests.
2. Determine every resolved GitPython version. A target is vulnerable if it
   resolves below `3.1.47`.
3. Search code paths that perform repository operations:
   - `Repo.clone_from()`;
   - `Repo.clone()`;
   - `Remote.fetch()`;
   - `Remote.pull()`;
   - `Remote.push()`;
   - `Submodule.update()`;
   - wrappers around repository import, mirror, sync, CI checkout, or agent
     workspace preparation.
4. Determine whether untrusted input can reach GitPython options:
   request bodies, webhook payloads, tenant settings, workflow YAML, job config,
   LLM/tool arguments, database records, environment variables, or "advanced
   options" fields.
5. If GitPython is absent or only used in non-deployable tooling, stop with
   `TRIAGE.md` explaining what was checked and why the runtime is not exposed.
6. Upgrade GitPython to `3.1.47+` on the smallest compatible release line.
   Regenerate lockfiles, constraints, images, SBOMs, and dependency reports.
7. Remove unsafe option pass-through:
   - do not pass user dictionaries directly as `**kwargs`;
   - do not pass user strings to `multi_options` or `clone_multi_options`;
   - reject `upload_pack`, `receive_pack`, `exec`, `config`, `c`,
     `core.hooksPath`, `GIT_SSH_COMMAND`, and equivalent normalized spellings;
   - represent supported behavior as typed fields, then map to a finite
     allow-list of safe GitPython arguments.
8. Add regression tests that do not execute commands:
   - `upload_pack` and `receive_pack` kwargs from untrusted input are rejected;
   - hyphen, underscore, and mixed-normalization forms are rejected;
   - `multi_options` strings containing embedded unsafe flags are rejected;
   - `clone_multi_options` for submodules uses the same validator;
   - validation happens after parsing/normalization, not only before it.
9. Harden repo-ingest execution where this repo controls it:
   - run workers as unprivileged users;
   - isolate workspaces per job;
   - scrub environment variables before Git operations;
   - scope SSH/deploy keys to the target repo and operation;
   - disable Git hooks or run with safe hook policy where supported.
10. Add a PR body section named `GitPython advisory operator actions` that
    states:
    - affected GitPython versions before and after the change;
    - which repo-operation paths were reachable by untrusted input;
    - whether free-form Git option features were removed or restricted;
    - which worker credentials should be rotated if exposure existed;
    - which logs should be reviewed for suspicious helper, hook, config, or SSH
      command options.
11. Run relevant validation: dependency install, unit tests, integration tests
    for repository import/sync, lint/typecheck, image build, SBOM refresh, and
    dependency/security scans available in this repository.
12. Use PR title:
    `fix(sec): remediate GitPython command injection advisories`.

## Stop conditions

- No deployable GitPython runtime is controlled by this repository.
- A fixed GitPython version cannot be consumed without a broader platform
  migration.
- Product requirements depend on arbitrary caller-controlled Git options;
  document the risk and require a product/security decision.
- Verification would require executing attacker-controlled hooks or helper
  commands.
- Validation fails for unrelated pre-existing reasons; document those failures
  instead of broadening scope.