CVE-2026-110858

NameCVE-2026-110858
DescriptionGitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4872-1, DSA-6594-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-git (PTS)bookworm3.1.30-1+deb12u2vulnerable
bookworm (security)3.1.30-1+deb12u3fixed
trixie3.1.44-1vulnerable
trixie (security)3.1.44-1+deb13u1fixed
forky, sid3.2.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-gitsourcebookworm3.1.30-1+deb12u3DLA-4872-1
python-gitsourcetrixie3.1.44-1+deb13u1DSA-6594-1
python-gitsource(unstable)3.2.1-1

Notes

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239
Fixed by: https://github.com/gitpython-developers/GitPython/commit/dafafff7e5438879d0167c17008342231f7af314 (3.2.0)
Search for package or bug name: Reporting problems