PT-2026-37179 · Pypi · Gitpython

Wesr

·

Published

2026-04-25

·

Updated

2026-05-26

·

CVE-2026-42215

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions GitPython versions 3.1.30 through 3.1.46
Description GitPython fails to properly validate certain Python keyword arguments, allowing a bypass of the safety checks intended to block dangerous Git options. While the library blocks options like --upload-pack and --receive-pack by default, using the underscore-form keyword arguments upload pack and receive pack bypasses this validation because the check occurs before the arguments are normalized into command-line flags. If an application passes attacker-controlled keyword arguments into the following functions, it can lead to arbitrary command execution even when allow unsafe options is set to False:
  • Repo.clone from()
  • Remote.fetch()
  • Remote.pull()
  • Remote.push()
Recommendations Update GitPython to version 3.1.47. As a temporary workaround, avoid passing user-controlled input into the upload pack and receive pack parameters of the Repo.clone from(), Remote.fetch(), Remote.pull(), and Remote.push() functions.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-06621
CVE-2026-42215
GHSA-RPM5-65CW-6HJ4
OESA-2026-2306
OESA-2026-2307
OESA-2026-2308
OPENSUSE-SU-2026:10758-1
USN-8303-1

Affected Products

Gitpython