new file mode 100644
@@ -0,0 +1,68 @@
+From ac1290549f1f8fa8ba19370805200f69b52a56db Mon Sep 17 00:00:00 2001
+From: "GPT 5.6" <codex@openai.com>
+Date: Wed, 22 Jul 2026 04:39:00 +0200
+Subject: [PATCH 15/38] fix: validate split short-option values
+
+<!-- agent -->
+
+Single-character keyword arguments are transformed into an option token and
+a separate value token. The unsafe-option candidate builder only checked the
+keyword name, allowing an option-like value to bypass guards shared by clone,
+remote, revision, blame, and archive operations.
+
+Include dash-prefixed values only when short options are actually split,
+including sequence values, while preserving bare values and the non-splitting
+compatibility path.
+
+Git baseline a23bace9 defines clone -n and --upload-pack as distinct options,
+matching the argv boundary this validation now preserves.
+
+Refs GHSA-r9mr-m37c-5fr3.
+
+CVE: CVE-2026-73625
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453]
+
+Backport Changes:
+- Omit upstream regression test changes because the current
+ PyPI source archive does not include its test suite.
+
+Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+(cherry picked from commit e8d0fbf774d1f6baa3b481adfe48bd262e43b453)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/cmd.py | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index 46619459..f907fa4e 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -626,6 +626,26 @@ class Git(LazyMixin):
+ f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
+ )
+
++ @classmethod
++ def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[str, Any]] = None) -> List[str]:
++ """Collect possible option spellings before command-line transformation."""
++ options = [
++ option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith("-")
++ ]
++ if kwargs:
++ split_single_char_options = kwargs.get("split_single_char_options", True)
++ for key, value in kwargs.items():
++ values = value if isinstance(value, (list, tuple)) else (value,)
++ if any(value is True or (value is not False and value is not None) for value in values):
++ key = str(key)
++ options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}")
++ if len(key) == 1 and split_single_char_options:
++ options.extend(
++ str(value)
++ for value in values
++ if value is not True and value not in (False, None) and str(value).startswith("-")
++ )
++ return options
+ class AutoInterrupt:
+ """Process wrapper that terminates the wrapped process on finalization.
+
+--
+2.35.6
@@ -28,6 +28,7 @@ SRC_URI += " file://CVE-2026-42284.patch \
file://CVE-2026-67324.patch \
file://CVE-2026-67322.patch \
file://CVE-2026-69097.patch \
+ file://CVE-2026-73625.patch \
"
SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453 [2] https://www.cve.org/CVERecord?id=CVE-2026-73625 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python/python3-git/CVE-2026-73625.patch | 68 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 69 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch