CVE-2026-110858 in GitPython
Summary
by MITRE • 10/15/2026
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The GitPython library, a popular Python interface for interacting with Git repositories, contains a critical remote code execution vulnerability in versions prior to 3.2.0. This flaw specifically affects the Remote.pull() method and stems from an insufficient validation of command-line arguments passed during git operations. The core technical issue lies in how the library constructs shell commands or invokes subprocesses when executing pull requests. While the developers implemented safeguards against unsafe options by inspecting keyword arguments, they failed to apply similar rigorous checks to positional arguments, particularly those related to refspecs. This oversight creates a significant security gap that allows attackers who can influence the input parameters of this function to bypass existing protections and execute arbitrary operating system commands with the privileges of the calling process.
The vulnerability is classified under CWE-78, which denotes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. In a typical scenario involving GitPython, developers use the Remote.pull() method to fetch updates from a remote repository and merge them into the current branch. The refspec parameter defines what references are fetched and how they map locally. Because the library does not adequately sanitize or validate this positional argument before passing it to the underlying git executable, an attacker who controls the input can inject malicious command-line flags. Specifically, by supplying --upload-pack= followed by a shell command, the attacker exploits the way Git processes upload pack requests during the fetch phase. This injection occurs regardless of whether the transport mechanism is local file system access or SSH-based remote connections, making the vulnerability broadly applicable across different deployment environments.
The operational impact of this vulnerability is severe due to its potential for full system compromise. Since the injected commands are executed by the process running GitPython, an attacker gains code execution capabilities equivalent to that user account. In web applications where Git operations might be triggered via API endpoints or scheduled tasks, this could lead to complete server takeover if the application runs with elevated privileges. Even in less privileged contexts, such as a developer's local machine or a containerized service running under a restricted user, successful exploitation allows for data exfiltration, lateral movement within internal networks, and persistence mechanisms that can evade standard security controls. The lack of input validation on positional arguments represents a fundamental design flaw where defensive coding practices were applied inconsistently across different parameter types.
To mitigate this risk, organizations using GitPython must upgrade to version 3.2.0 or later, which addresses the insufficient validation by ensuring all command-line parameters are properly sanitized before execution. For environments that cannot immediately patch due to compatibility constraints, temporary mitigations include implementing strict input validation at the application layer to reject any refspec strings containing special characters like equals signs or hyphens preceding known git options. Additionally, restricting file system permissions and employing least-privilege principles can limit the blast radius of a successful exploitation attempt. Security teams should also monitor for unusual subprocess activity originating from Python processes interacting with Git repositories as part of their detection strategies aligned with MITRE ATT&CK techniques related to command and script interpretation.