CVE-2026-110859 in GitPython
Summary
by MITRE • 10/15/2026
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in versions of GitPython prior to 3.2.0 represents a critical argument injection flaw within the Head.checkout() method. This security issue stems from insufficient validation and sanitization of user-supplied input when constructing command-line arguments for underlying git operations. Specifically, the function fails to properly escape or reject special characters that are interpreted by the shell as options rather than literal branch names. When a remote repository is configured with a default branch name that mimics valid Git CLI flags, such as --pathspec-from-file=, the vulnerable code passes this string directly into the command execution pipeline without adequate safeguards. This lack of input validation allows an attacker to inject arbitrary arguments into the git process, fundamentally altering its behavior beyond the intended scope of checking out a specific branch reference.
The operational impact of this vulnerability is severe, primarily manifesting as unauthorized data exfiltration through information disclosure. By hosting a malicious repository with a specially crafted default branch name, an adversary can trick applications that automatically clone and checkout the active branch into executing unintended git commands. The injection of --pathspec-from-file= causes Git to read file contents from arbitrary locations on the victim's filesystem and include them in its output or error messages. Consequently, sensitive files such as configuration settings, private keys, or internal source code can be leaked back to the attacker via standard exception traces like GitCommandError. This mechanism effectively bypasses traditional access controls because it exploits the trust relationship between the application and the git binary, turning a routine version control operation into a vector for reading arbitrary local files.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as command injection. The root cause is the failure to neutralize special elements that could change the intended intent of a system-level command. In terms of offensive security frameworks, this technique corresponds to ATT&CK tactic T1059 Command and Scripting Interpreter, specifically leveraging sub-components like sh or bash for argument injection. It also relates to data exfiltration techniques where attackers use legitimate administrative tools to steal information from the local environment. The vulnerability highlights a common pitfall in security-conscious software development: assuming that input representing identifiers such as branch names are safe when they can be interpreted by downstream command-line parsers as executable flags or options.
Mitigation strategies for this issue involve immediate upgrading of GitPython to version 3.2.0 or later, where the argument injection flaw has been addressed through improved input handling and sanitization logic. For environments unable to upgrade immediately, developers should implement strict allow-listing for branch names, ensuring that only alphanumeric characters and standard naming conventions are accepted before passing them to git commands. Additionally, avoiding direct string concatenation when building command-line arguments in favor of using argument lists or parameterized execution methods can prevent shell interpretation issues. Security teams should also audit codebases for similar patterns where external inputs influence system-level command construction, particularly in applications interacting with version control systems or other CLI-based tools that are susceptible to option injection attacks.