CVE-2026-110857

Awaiting Analysis Awaiting Analysis - Queue

Remote Code Execution in GitPython

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110857

EUVD

EUVD-2026-101740

Affected Vendors & Products

Vendor	Product	Version / Range
gitpython-developers	GitPython	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1287	The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

Executive Summary

GitPython before version 3.2.0 has a remote code execution vulnerability. It allows attackers to run arbitrary commands by exploiting Git.ls_remote's failure to validate URLs properly. Attackers can use specially crafted ext:: remote-helper URLs to execute commands when the git ext transport is permitted. Other functions like merge_base and IndexFile.move also allow unguarded option injection.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of GitPython. Use pip to list installed packages and compare versions: pip show GitPython. If the version is below 3.2.0, the system is vulnerable. Additionally, inspect code using GitPython for usage of Git.ls_remote, merge_base, or IndexFile.move with untrusted input.

Impact Analysis

If you use GitPython before 3.2.0, attackers could remotely execute commands on your system by tricking you into processing malicious URLs. This could lead to unauthorized access, data theft, or system compromise depending on the permissions of the affected application.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade GitPython to version 3.2.0 or later immediately. If upgrading is not possible, avoid using Git.ls_remote, merge_base, or IndexFile.move with untrusted input. Review and sanitize all URLs or options passed to these functions to prevent command injection.

Hi! I’m here to help you understand CVE-2026-110857. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70