Security: Command injection via shell=True in git command execution (CWE-78) #1918
Description
Summary
commitizen uses subprocess.Popen(cmd, shell=True) in commitizen/cmd.py to execute all git commands. Multiple functions in commitizen/git.py construct shell commands by interpolating values via f-strings without escaping.
Affected Code
commitizen/cmd.py lines 41-43:
process = subprocess.Popen(cmd, shell=True, ...)commitizen/git.py line 173:
return cmd.run(f'git tag {option} {tag} -m "{msg or tag}"')commitizen/git.py line 167:
return cmd.run(f"git tag {tag}")commitizen/git.py line 177:
return cmd.run(f"git add {' '.join(args)}")Attack Vector
An attacker poisons pyproject.toml (e.g., via PR) with:
[tool.commitizen]
annotated_tag = true
annotated_tag_message = 'Release" && malicious_command && echo "'When CI/CD runs cz bump, the shell interprets the injected command.
Impact
- Arbitrary command execution in CI/CD pipelines
- CVSS 3.1: 7.8 (High)
- Similar to CVE-2026-33718 (OpenHands command injection via git operations)
Suggested Fix
Replace shell=True with list-based subprocess, or use shlex.quote():
subprocess.run(["git", "tag", option, tag, "-m", msg or tag])Reported by: Tom Chen (hypery11@gmail.com)
Activity
PhilipNelson5 commentedon Apr 15, 2026
shlex.quote()is probably not a viable solution because it's only designed for POSIX shells.fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78)
fix(security): prevent command injection via shell=True (CWE-78) (#1941)
bearomorphism commentedon May 6, 2026
Thank you all for reporting this issue! The fix was just checked in
hypery11 commentedon Oct 12, 2026
Thanks for the fix in #1941 and the quick 4.15.1 release.
Would you be open to publishing a GitHub Security Advisory for this? It would let Dependabot and other scanners tell users on older versions to upgrade. The details should be simple:
< 4.15.14.15.1CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)One note: I've already requested a CVE ID from MITRE for this, so there's no need to request another one through GitHub. I'll post the ID here once it's assigned so it can be added to the advisory.
If you do publish one, I'd appreciate being credited as the reporter (@hypery11). Happy to draft the advisory text if that helps.