{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/gitpython--3.1.30--3.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitPython (\u003e= 3.1.30, \u003c 3.2.0)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","gitpython","library-vulnerability"],"_cs_type":"advisory","_cs_vendors":["GitPython"],"content_html":"\u003cp\u003eGitPython's \u003ccode\u003eRemote.pull()\u003c/code\u003e method contains a vulnerability in its security guard intended to prevent command injection. While the library attempts to block dangerous options like \u003ccode\u003e--upload-pack\u003c/code\u003e, the guard only inspects keyword arguments and fails to validate the positional \u003ccode\u003erefspec\u003c/code\u003e argument. An attacker can supply a refspec starting with \u003ccode\u003e--upload-pack=\u003c/code\u003e, which is forwarded to the underlying \u003ccode\u003egit pull\u003c/code\u003e process. Because \u003ccode\u003egit pull\u003c/code\u003e does not properly terminate positional arguments before passing them to internal \u003ccode\u003egit fetch\u003c/code\u003e operations, the injected command is executed as the \u003ccode\u003eupload-pack\u003c/code\u003e program. Exploitation is possible when using local filesystem or SSH transports. No fix is currently available.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eExposure: An application calls \u003ccode\u003eRemote.pull(refspec=\u0026lt;value\u0026gt;)\u003c/code\u003e where \u003ccode\u003e\u0026lt;value\u0026gt;\u003c/code\u003e is derived from attacker-influenced input.\u003c/li\u003e\n\u003cli\u003eControl: The attacker provides a string such as \u003ccode\u003e--upload-pack=\u0026lt;command\u0026gt;; git-upload-pack\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ePath: The input passes through \u003ccode\u003eGit._unpack_args\u003c/code\u003e and \u003ccode\u003eGit.check_unsafe_protocols\u003c/code\u003e without being flagged as malicious.\u003c/li\u003e\n\u003cli\u003eGuard: The unsafe-option guard incorrectly assumes positionals are safe, failing to check the \u003ccode\u003erefspec\u003c/code\u003e against \u003ccode\u003eunsafe_git_pull_options\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ePrimitive: The \u003ccode\u003erefspec\u003c/code\u003e is passed to \u003ccode\u003egit pull -v -- \u0026lt;remote\u0026gt; \u0026lt;refspec\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eExecution: The \u003ccode\u003egit pull\u003c/code\u003e command forwards the positional to an internal \u003ccode\u003egit fetch\u003c/code\u003e without a \u003ccode\u003e--\u003c/code\u003e separator, causing the system to execute the injected command as the \u003ccode\u003eupload-pack\u003c/code\u003e program.\u003c/li\u003e\n\u003cli\u003eResult: Arbitrary command execution occurs on the system with the privileges of the calling process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows arbitrary command execution as the user running the GitPython process. This requires the use of SSH or local filesystem transports; HTTPS transports are not affected as the server ignores the client-supplied upload-pack program.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eValidate that all \u003ccode\u003erefspec\u003c/code\u003e strings passed to \u003ccode\u003eRemote.pull()\u003c/code\u003e do not start with a hyphen (\u003ccode\u003e-\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003ePrefer HTTPS remotes over local-path or SSH transports where possible.\u003c/li\u003e\n\u003cli\u003eAvoid passing untrusted user input directly into GitPython method arguments.\u003c/li\u003e\n\u003cli\u003eMonitor for GitPython processes spawning child processes that are not standard git utilities or that originate from unexpected command-line arguments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T23:25:26Z","date_published":"2026-10-29T23:25:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gitpython-rce-8a12154e/","summary":"The GitPython library fails to validate the refspec positional argument in Remote.pull(), allowing attackers to inject shell commands via --upload-pack options when using SSH or local transports.","title":"GitPython: Remote.pull() arbitrary command execution via refspec injection","url":"https://feed.craftedsignal.io/briefs/2026-10-gitpython-rce-8a12154e/"}],"language":"en","title":"CraftedSignal Threat Feed - GitPython (\u003e= 3.1.30, \u003c 3.2.0)","version":"https://jsonfeed.org/version/1.1"}