CVE-2026-42215High· 7.5▾ TwilightA flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments (kwargs) to functions such as Rep…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.7%
0.7% → 0.7%
7.5 → 8.8
8.8 → 7.5
7.5 → 8.8
8.8 → 7.5
7.5 → 8.8
8.8 → 7.5
7.5 → 8.8
8.8 → 7.5
7.5 → 8.8
8.8 → 7.5
7.5 → 8.8
8.8 → 7.5
Last analysed / modified upstream
A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments (kwargs) to functions such as Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(). This bypasses existing security checks designed to block dangerous Git options, enabling the execution of unauthorized commands.
GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks — rated Important by Red Hat. Released 2026-05-07, updated 2026-09-22.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:42078 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:42079 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For detailed instructions how to apply this update, refer to:
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:63385
Workarounds / mitigations:
Affected packages:
gitpython >= 3.1.30, < 3.1.47Patched in:
gitpython 3.1.47Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42284High· 7.5GitPython: GitPython: Arbitrary code execution via improper validation of clone options (CVE-2026-42284)
CVE-2026-78679Medium· 6.5GitPython: GitPython: Arbitrary file read via TagReference.create() (CVE-2026-78679)
CVE-2026-78676Critical· 9.8gitpython: GitPython before 3.1.59 Remote Code Execution via Config Injection (CVE-2026-78676)
CVE-2026-76220High· 8.8gitpython: GitPython: Arbitrary command execution via crafted kwargs (CVE-2026-76220)
CVE-2026-76218High· 7.5gitpython: GitPython: Remote Code Execution via malicious Git hooks (CVE-2026-76218)
CVE-2026-76219High· 8.1gitpython: GitPython: Arbitrary File Overwrite via `git read-tree` option injection (CVE-2026-76219)