{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/gitpython--3.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-110857"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitPython (\u003c 3.2.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["GitPython"],"content_html":"\u003cp\u003eGitPython versions before 3.2.0 are vulnerable to remote code execution (RCE) and option injection due to insufficient input validation within several key methods. The vulnerability primarily stems from the Git.ls_remote method, which forwards user-provided URLs to the underlying git binary without validating against unsafe protocols. An attacker can leverage this to supply 'ext::' remote-helper URLs, which can be configured to execute arbitrary commands if the system's git environment permits the 'ext' transport protocol. Furthermore, the library's merge_base and IndexFile.move methods fail to sanitize inputs, rendering them susceptible to option injection attacks. This vulnerability poses a significant risk to applications that process untrusted repository URLs or Git-related inputs, potentially allowing unauthorized system access under the context of the service running the GitPython library.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote attackers to execute arbitrary commands on systems running applications that utilize GitPython (\u0026lt; 3.2.0) to process user-provided repository URLs or file operations. This vulnerability affects any environment using the vulnerable library, across Linux, Windows, or macOS, and could lead to full system compromise depending on the privileges of the application process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade GitPython to version 3.2.0 or later immediately to patch CVE-2026-110857.\u003c/li\u003e\n\u003cli\u003eAudit applications utilizing GitPython to identify code paths where user-supplied strings are passed to the 'ls_remote', 'merge_base', or 'move' methods.\u003c/li\u003e\n\u003cli\u003eEnsure that the underlying git configuration on production servers has the 'ext' transport protocol disabled or restricted to prevent the exploitation of remote-helper URLs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T00:34:08Z","date_published":"2026-10-15T00:33:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gitpython-rce/","summary":"GitPython versions prior to 3.2.0 contain a remote code execution vulnerability where the Git.ls_remote method improperly handles URLs, allowing arbitrary command execution via malicious remote-helper strings.","title":"Remote Code Execution in GitPython via Unsafe URL Handling","url":"https://feed.craftedsignal.io/briefs/2026-10-gitpython-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - GitPython (\u003c 3.2.0)","version":"https://jsonfeed.org/version/1.1"}