GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.
References
| Link | Resource |
|---|---|
| https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47 | Patch Release Notes |
| https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4 | Exploit Vendor Advisory |
| https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4 | Exploit Vendor Advisory |
Configurations
History
11 May 2026, 17:45
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Gitpython Project gitpython
Gitpython Project |
|
| CPE | cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* | |
| References | () https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47 - Patch, Release Notes | |
| References | () https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4 - Exploit, Vendor Advisory |
08 May 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4 - |
07 May 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-07 19:16
Updated : 2026-05-11 17:45
NVD link : CVE-2026-42215
Mitre link : CVE-2026-42215
CVE.ORG link : CVE-2026-42215
JSON object : View
Products Affected
gitpython_project
- gitpython
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')