Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-110858

GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

gitpython-developers GitPython

Default version status: unaffected

  • 3.1.30 to < 3.2.0affected
  • 3.2.0unaffected
pkg:pypi/GitPython

References