What causes "Invalid Git parameter: {parameter}" in python-poetry/poetry?

Sanitize the URL/revision so its stripped form does not begin with '-'.

python-poetry/poetry · error · RuntimeError

Invalid Git parameter: {parameter}

Error message

Invalid Git parameter: {parameter}

What it means

SystemGit._check_parameter rejects any parameter (a repository URL or a revision) whose stripped form begins with '-', raising RuntimeError. This is a security guard against git argument/option injection: without it, a crafted value could be interpreted as a git flag (e.g. '--upload-pack=...') enabling code execution. Both SystemGit.clone and SystemGit.checkout run every user-supplied value through this check.

Source

Thrown at src/poetry/vcs/git/system.py:59

        env = os.environ.copy()
        env["GIT_TERMINAL_PROMPT"] = "0"

        subprocess.run(
            git_command + list(args),
            capture_output=True,
            env=env,
            text=True,
            encoding="utf-8",
            check=True,
        )

    @staticmethod
    def _check_parameter(parameter: str) -> None:
        """
        Checks a git parameter to avoid unwanted code execution.
        """
        if parameter.strip().startswith("-"):
            raise RuntimeError(f"Invalid Git parameter: {parameter}")

View on GitHub (pinned to 92b74dcfe3)

Solutions

Sanitize the URL/revision so its stripped form does not begin with '-'.
Use a legitimate git URL (https://..., git@..., ssh://...) and a real ref/sha.
If the value genuinely must contain a leading dash, rework the configuration so it is passed as a value, not a flag (git supports '--' separator, but Poetry refuses it for safety).

Example fix

# before - value starts with a dash
lib = { git = "--upload-pack=/tmp/evil" }
# after - use a real repository url
lib = { git = "https://github.com/acme/lib.git", rev = "abcdef0" }

Defensive patterns

Strategy: validation

Validate before calling

def is_safe_git_parameter(parameter: str) -> bool:
    return not parameter.strip().startswith('-')

Type guard

def is_safe_git_parameter(parameter: str) -> bool:
    return isinstance(parameter, str) and not parameter.strip().startswith('-')

Try / catch

from poetry.vcs.git.system import SystemGit
try:
    SystemGit.clone(repository, dest)
except RuntimeError as e:
    if 'Invalid Git parameter' in str(e):
        # sanitize the url/rev so it does not start with '-'
        raise

Prevention

Sanitize user-supplied URLs/revisions: reject any whose stripped form starts with '-'.
Use well-formed git URLs and real refs only.
Treat leading-dash values as untrusted input to prevent git option injection.

When it happens

Trigger: Passing a git dependency URL or a rev that starts with '-' after stripping whitespace, e.g. a repository value of '--upload-pack=evil' or a rev like '-c core.xxx'.

Common situations: A security-hardening rejection of injection attempts; a malformed ref/URL produced by a templating bug that prepends a stray dash; a config that accidentally starts the value with a flag character.

Related errors

AI-assisted analysis of python-poetry/poetry@92b74dcfe3 (2026-08-04). Data as JSON: /data/errors/9b96d423e955e440.json. Report an issue: GitHub.