8.1Yüksek
CVE-2026-110858GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
Açıklama
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.
Zayıflık türü (CWE):
CWE-88
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| gitpython project | gitpython | 3.1.30 – < 3.2.0 | |
| gitpython-developers | GitPython | 3.1.30 – < 3.2.0, fixed 3.2.0 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-f9j4-qggq-h239) vendor-advisory
- VulnCheck Advisory: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec third-party-advisory