CVE-2026-110857 in GitPython
Summary
by MITRE • 10/15/2026
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The security flaw identified in versions of GitPython prior to 3.2.0 represents a critical Remote Code Execution vulnerability stemming from insufficient input validation within core library functions that interface with the underlying Git executable. The primary vector for exploitation involves the ls_remote function, which is designed to list references available on a remote repository. In vulnerable implementations, this function forwards URLs directly to the git command-line tool without applying necessary safety checks, specifically bypassing the check_unsafe_protocols validation logic. This oversight allows an attacker who controls or influences the URL input to inject malicious arguments that are passed through to the operating system shell during execution of external Git processes.
The technical mechanism of exploitation relies on the ability to supply ext remote-helper URLs to the affected functions. When a user provides such a URL, and if the local git installation permits the use of the ext transport helper, the library inadvertently facilitates command injection. The attacker can craft a specially formatted URL that triggers arbitrary code execution on the host system where GitPython is running. This occurs because the underlying git process interprets parts of the maliciously crafted input as executable commands or arguments to external helpers rather than treating them strictly as repository identifiers. Consequently, any user with access to supply these URLs within an application utilizing this library version can achieve arbitrary command execution with the privileges of the process running GitPython.
Beyond the ls_remote function, the vulnerability extends to other critical operations such as merge_base and IndexFile.move. These functions also suffer from unguarded option injection flaws. In the case of merge_base, attackers may inject options that alter how git computes common ancestors between commits, potentially leading to unintended side effects or further exploitation paths depending on subsequent code logic. Similarly, IndexFile.move is susceptible to argument injection when handling file path operations within the index. These additional vectors indicate a systemic lack of rigorous sanitization across multiple entry points in the library’s API, increasing the attack surface for potential adversaries targeting applications that rely on GitPython for version control automation or repository management tasks.
The operational impact of this vulnerability is severe, particularly for web applications and automated systems that process untrusted git URLs from external sources. An attacker could exploit this to compromise the integrity and confidentiality of the host system, install backdoors, exfiltrate sensitive data, or pivot further into internal networks if the compromised server has broader access rights. Since GitPython is widely used in continuous integration pipelines, deployment scripts, and developer tools, a successful exploitation can disrupt business operations and lead to significant financial and reputational damage. The lack of validation means that even seemingly benign interactions with remote repositories can be weaponized if the input originates from an untrusted source or has been tampered with by a man-in-the-middle attacker.
To mitigate this risk, organizations must immediately upgrade GitPython to version 3.2.0 or later, where these specific validation checks have been implemented and enforced. For environments that cannot update instantly due to dependency constraints, it is crucial to implement strict input sanitization at the application layer before passing any URLs or file paths to GitPython functions. This includes validating URL schemes against a whitelist of safe protocols and ensuring that no shell metacharacters are present in inputs intended for git operations. Additionally, running applications with minimal privileges can help limit the blast radius should an exploitation attempt succeed.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The failure to validate user-supplied input before constructing system commands is the root cause. In terms of tactical mapping within the MITRE ATT&CK framework, this exploitation technique falls under T1059 Command and Scripting Interpreter, specifically involving indirect command execution through external utilities like git. Security teams should monitor for unusual process creation events related to git or python processes that exhibit unexpected argument patterns indicative of injection attempts. Regular vulnerability scanning and adherence to secure coding practices regarding subprocess invocation are essential defenses against such flaws in software supply chains.