CRITICAL 9.2 NVD
CVE-2026-110858
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, no
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.
References
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239
- https://www.vulncheck.com/advisories/gitpython-3.1.30-before-3.2.0-command-injection-via-r
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-10-14 via NVD.
Risk Timeline
CVE Disclosed2026-10-14 · 0 days ago
Remediation Resources
vulnfeed aggregates 15100 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.