Arbitrary Command Execution Risk in GitPython Library by GitPython Developers
CVE-2026-42215

8.8HIGH

Key Information:

Vendor

Gitpython-developers

Status
Gitpython
Vendor
CVE Published:
7 May 2026

What is CVE-2026-42215?

GitPython, a Python library for interacting with Git repositories, has a vulnerability affecting versions from 3.1.30 to prior to 3.1.47. This issue arises from a flaw in how the library handles certain dangerous Git options, such as --upload-pack and --receive-pack. Although these options are blocked by default, malicious users can bypass this limitation through the Python keyword arguments upload_pack and receive_pack when using methods like Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(). This can lead to arbitrary command execution, even when allow_unsafe_options is set to its default value of False. Developers are advised to upgrade to version 3.1.47, where this issue has been addressed.

Affected Version(s)

GitPython >= 3.1.30, < 3.1.47

References

https://github.com/gitpython-developers/GitPython/securit...
x_refsource_CONFIRM
https://github.com/gitpython-developers/GitPython/release...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.