CVE-2026-110858

Awaiting Analysis Awaiting Analysis - Queue

Remote Code Execution in GitPython via Unsafe Refspec Handling

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110858

EUVD

EUVD-2026-101741

Affected Vendors & Products

Vendor	Product	Version / Range
gitpython-developers	GitPython	3.1.30

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

GitPython versions from 3.1.30 to before 3.2.0 have a remote code execution flaw in the Remote.pull() function. The vulnerability occurs because the unsafe-option guard only checks keyword arguments and not the positional refspec parameter. Attackers can exploit this by providing a malicious refspec with --upload-pack=<command> to execute arbitrary OS commands as the user running the GitPython process. This works over local-path or SSH transports.

Detection Guidance

To detect this vulnerability, check if your system uses GitPython versions between 3.1.30 and 3.2.0. Run: pip show GitPython to verify the installed version. If vulnerable, update to version 3.2.0 or later immediately.

Impact Analysis

If you use a vulnerable version of GitPython and call Remote.pull() with user-controlled input for the refspec, attackers could execute arbitrary commands on your system. This could lead to full system compromise, data theft, or further network infiltration depending on the permissions of the user running the affected application.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or loss of sensitive information. Such incidents may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, leading to regulatory penalties, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade GitPython to version 3.2.0 or later using pip install --upgrade GitPython. Review any scripts using GitPython to ensure they do not pass untrusted refspec arguments to Remote.pull().

Hi! I’m here to help you understand CVE-2026-110858. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70