PT-2026-37191 · Pypi+2 · Gitpython+2

Texuguinho1234 · Published 2026-04-25 · Updated 2026-06-03 · CVE-2026-42284

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.47

Description GitPython is a Python library used to interact with Git repositories. The clone() function validates the multi options variable as an original list but then executes shlex.split(" ".join(multi options)). This allows a string that starts with a safe option, such as --branch, to pass validation while containing unsafe options like --config core.hooksPath=/x. After the split operation, the unsafe option becomes a separate token that Git applies, potentially leading to the execution of attacker-controlled hooks during the clone process. This issue also affects Submodule.update() via clone multi options. The vulnerability occurs when applications pass user-controlled input to clone from(), clone(), or Submodule.update().

Recommendations Update to version 3.1.47.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-42284

GHSA-X2QX-6953-8485

USN-8303-1

Affected Products

Gitpython

Linuxmint

Ubuntu

References · 24

• 🔥 https://tenable.com/cve/CVE-2026-32686 · Exploit
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485 · Vendor Advisory
• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47 · Patch
• https://safe-surf.ru/specialists/bulletins-nkcki/731968 · Security Note
• https://ubuntu.com/security/CVE-2023-41040 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42284 · Security Note
• https://ubuntu.com/security/notices/USN-8303-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42284 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-42284 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42284 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42284 · Security Note
• https://osv.dev/vulnerability/USN-8303-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44244 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42284 · Vendor Advisory