CVE-2026-42215
High · 8.8CVSS
8.8
EPSS
0.9%
Published
May 7, 2026
CISA due date
—
The record
GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-GitPython | 0 | 3.1.49-1.1 |
Related vulnerabilities
- CVE-2026-44243 GitPython is a python library used to interact with Git repositories. Also affects python-GitPython
- CVE-2026-44244 GitPython is a python library used to interact with Git repositories. Also affects python-GitPython
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. CWE-78