CVE-2026-110857

7.5High

Published 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-1287

Impact

Attackers can achieve remote code execution by tricking an application into passing a malicious 'ext::' URL or injected options to GitPython functions. Exploitation requires user interaction or untrusted input reaching functions like Git.ls_remote, merge_base, or IndexFile.move where git allows the ext transport.

Root cause

Git.ls_remote forwards URLs without validating them via check_unsafe_protocols, allowing arbitrary command execution via git's ext:: remote helper, alongside unguarded option injection in merge_base and IndexFile.move.

Affected systems

GitPython before 3.2.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade GitPython to version 3.2.0 or later. If you cannot upgrade immediately, sanitize untrusted URLs before passing them to GitPython by rejecting 'ext::' protocol schemes and validate inputs passed to merge_base and IndexFile.move.

shell

$ pip install --upgrade 'GitPython>=3.2.0'

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110857