CVE-2026-110859

Awaiting Analysis Awaiting Analysis - Queue

GitPython Argument Injection via Branch Name

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110859

EUVD

EUVD-2026-101742

Affected Vendors & Products

Vendor	Product	Version / Range
gitpython-developers	GitPython	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

GitPython before 3.2.0 has an argument injection flaw in Head.checkout(). Attackers can exploit this by naming a repository's default branch something like --pathspec-from-file=<path>, which causes cloning apps to leak file contents when checking out the branch. This happens because GitPython parses branch names as git options.

Detection Guidance

Check GitPython version with pip show GitPython. If version is below 3.2.0, the system is vulnerable. Review Git operations in applications using GitPython for unusual branch names or error messages indicating file path disclosures.

Impact Analysis

If you use GitPython versions before 3.2.0, an attacker could trick your application into reading sensitive files by hosting a malicious repository. This could expose confidential data like configuration files or credentials through error messages.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using vulnerable GitPython versions may face compliance violations if sensitive data is leaked.

Mitigation Strategies

Upgrade GitPython to version 3.2.0 or higher immediately. Audit applications using GitPython for potential exploitation and review logs for unauthorized file access attempts. Disable automatic branch checkout in scripts if not required.

Hi! I’m here to help you understand CVE-2026-110859. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70