Remote Code Execution Flaw in GitPython by GitPython Developers
CVE-2026-110858

9.2CRITICAL

Key Information:

Vendor

Gitpython-developers

Status
Gitpython
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110858?

GitPython versions prior to 3.2.0 contain a vulnerability in the Remote.pull() method that allows an attacker to exploit the application via the positional refspec. This flaw permits attackers to execute arbitrary operating system commands by controlling the refspec and providing the unsafe-option '--upload-pack=', potentially leading to severe breaches of security. Affected users are urged to upgrade to the latest version to mitigate risks.

Affected Version(s)

GitPython 3.1.30 < 3.2.0

GitPython 3.2.0

References

https://github.com/gitpython-developers/GitPython/securit...
vendor-advisory
https://www.vulncheck.com/advisories/gitpython-3.1.30-bef...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
manus-use
.