8.1Hoch
CVE-2026-110858GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
Beschreibung
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.
Schwachstellentyp (CWE):
CWE-88
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| gitpython project | gitpython | 3.1.30 – < 3.2.0 | |
| gitpython-developers | GitPython | 3.1.30 – < 3.2.0, fixed 3.2.0 |
Referenzen und Patches
- GitHub Security Advisory (GHSA-f9j4-qggq-h239) vendor-advisory
- VulnCheck Advisory: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec third-party-advisory