Code Execution Vulnerability in GitPython by GitPython Developers
CVE-2026-42284

8.1HIGH

Key Information:

Vendor

Gitpython-developers

Status
Gitpython
Vendor
CVE Published:
7 May 2026

What is CVE-2026-42284?

GitPython, a Python library designed for Git repository management, contains a vulnerability that allows for code execution during the cloning process. Before version 3.1.47, the _clone() function inadequately validated multi_options. An attacker could craft malicious input that, although appearing valid initially, gets split and executed, leading to the application of potentially harmful configurations and hooks. This security risk underscores the importance of keeping GitPython updated to mitigate unauthorized code execution vulnerabilities.

Affected Version(s)

GitPython < 3.1.47

References

https://github.com/gitpython-developers/GitPython/securit...
x_refsource_CONFIRM
https://github.com/gitpython-developers/GitPython/release...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.