Security: Command injection via shell=True in git command execution (CWE-78)

Summary

commitizen uses subprocess.Popen(cmd, shell=True) in commitizen/cmd.py to execute all git commands. Multiple functions in commitizen/git.py construct shell commands by interpolating values via f-strings without escaping.

Affected Code

commitizen/cmd.py lines 41-43:

process = subprocess.Popen(cmd, shell=True, ...)

commitizen/git.py line 173:

return cmd.run(f'git tag {option} {tag} -m "{msg or tag}"')

commitizen/git.py line 167:

return cmd.run(f"git tag {tag}")

commitizen/git.py line 177:

return cmd.run(f"git add {' '.join(args)}")

Attack Vector

An attacker poisons pyproject.toml (e.g., via PR) with:

[tool.commitizen]
annotated_tag = true
annotated_tag_message = 'Release" && malicious_command && echo "'

When CI/CD runs cz bump, the shell interprets the injected command.

Impact

Arbitrary command execution in CI/CD pipelines
CVSS 3.1: 7.8 (High)
Similar to CVE-2026-33718 (OpenHands command injection via git operations)

Suggested Fix

Replace shell=True with list-based subprocess, or use shlex.quote():

subprocess.run(["git", "tag", option, tag, "-m", msg or tag])

Reported by: Tom Chen (hypery11@gmail.com)

shlex.quote() is probably not a viable solution because it's only designed for POSIX shells.

Warning: The shlex module is only designed for Unix shells.

The quote() function is not guaranteed to be correct on non-POSIX compliant shells or shells from other operating systems such as Windows. Executing commands quoted by this module on such shells can open up the possibility of a command injection vulnerability.

Consider using functions that pass command arguments with lists such as subprocess.run() with shell=False.

https://docs.python.org/3/library/shlex.html#shlex.quote

fix(security): prevent command injection via shell=True (CWE-78)

fix(security): prevent command injection via shell=True (CWE-78) (#1941)

Thank you all for reporting this issue! The fix was just checked in

Navigation Menu

Repository navigation

Security: Command injection via shell=True in git command execution (CWE-78) #1918

Summary

Affected Code

Attack Vector

Impact

Suggested Fix

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Security: Command injection via shell=True in git command execution (CWE-78) #1918

Description

Summary

Affected Code

Attack Vector

Impact

Suggested Fix

Activity

PhilipNelson5 commented on Apr 15, 2026

bearomorphism commented on May 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions