new file mode 100644
@@ -0,0 +1,61 @@
+From 341a49149a37762e12b10eb70605b54f4abfb54d Mon Sep 17 00:00:00 2001
+From: w <w@mac.lan>
+Date: Mon, 20 Apr 2026 23:29:50 -0400
+Subject: [PATCH] Block unsafe underscored git kwargs / Fix for
+ GHSA-rpm5-65cw-6hj4
+
+CVE: CVE-2026-42215
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/142195888e713542189533a52cdfc333f05c3af6]
+
+Backport Changes:
+- Omit regression tests because the Scarthgap PyPI source
+ archive does not include the upstream test suite.
+
+(cherry picked from commit 142195888e713542189533a52cdfc333f05c3af6)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ git/cmd.py | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index f58e6df5..874acb43 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -540,6 +540,12 @@ class Git(LazyMixin):
+ f"The `{protocol}::` protocol looks suspicious, use `allow_unsafe_protocols=True` to allow it."
+ )
+
++ @classmethod
++ def _canonicalize_option_name(cls, option: str) -> str:
++ """Normalize an option or kwarg name for unsafe-option checks."""
++ option_name = option.lstrip("-").split("=", 1)[0].split(None, 1)[0]
++ return dashify(option_name)
++
+ @classmethod
+ def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:
+ """Check for unsafe options.
+@@ -547,15 +553,14 @@ class Git(LazyMixin):
+ Some options that are passed to `git <command>` can be used to execute
+ arbitrary commands, this are blocked by default.
+ """
+- # Options can be of the form `foo` or `--foo bar` `--foo=bar`,
+- # so we need to check if they start with "--foo" or if they are equal to "foo".
+- bare_unsafe_options = [option.lstrip("-") for option in unsafe_options]
++ # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`.
++ canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options}
+ for option in options:
+- for unsafe_option, bare_option in zip(unsafe_options, bare_unsafe_options):
+- if option.startswith(unsafe_option) or option == bare_option:
+- raise UnsafeOptionError(
+- f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
+- )
++ unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option))
++ if unsafe_option is not None:
++ raise UnsafeOptionError(
++ f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
++ )
+
+ class AutoInterrupt:
+ """Process wrapper that terminates the wrapped process on finalization.
+--
+2.35.6
new file mode 100644
@@ -0,0 +1,47 @@
+From 3385ff27397b58288d922838e8d2eae87d7534fd Mon Sep 17 00:00:00 2001
+From: w <w@mac.lan>
+Date: Tue, 21 Apr 2026 12:03:20 -0400
+Subject: [PATCH] git.cmd: harden unsafe option canonicalization and isolate
+ push test cases
+
+CVE: CVE-2026-42215
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/43d92dec4683568d11495956dd556161f17c3ea8]
+
+Backport Changes:
+- Omit regression test updates because the Scarthgap PyPI
+ source archive does not include the upstream test suite.
+
+(cherry picked from commit 43d92dec4683568d11495956dd556161f17c3ea8)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ git/cmd.py | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index 69756216..73b4c052 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -542,9 +542,18 @@ class Git(LazyMixin):
+
+ @classmethod
+ def _canonicalize_option_name(cls, option: str) -> str:
+- """Normalize an option or kwarg name for unsafe-option checks."""
+- option_name = option.lstrip("-").split("=", 1)[0].split(None, 1)[0]
+- return dashify(option_name)
++ """Return the option name used for unsafe-option checks.
++
++ Examples:
++ ``"--upload-pack=/tmp/helper"`` -> ``"upload-pack"``
++ ``"upload_pack"`` -> ``"upload-pack"``
++ ``"--config core.filemode=false"`` -> ``"config"``
++ """
++ option_name = option.lstrip("-").split("=", 1)[0]
++ option_tokens = option_name.split(None, 1)
++ if not option_tokens:
++ return ""
++ return dashify(option_tokens[0])
+
+ @classmethod
+ def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:
+--
+2.35.6
@@ -13,6 +13,8 @@ PYPI_PACKAGE = "GitPython"
inherit pypi python_setuptools_build_meta
SRC_URI += "file://CVE-2026-42284.patch \
+ file://CVE-2026-42215_p1.patch \
+ file://CVE-2026-42215_p2.patch \
"
SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"