CVE-2026-42215: GitPython has Command Injection via Git options bypass

April 25, 2026 (updated May 8, 2026)

GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False.

References

github.com/advisories/GHSA-rpm5-65cw-6hj4
github.com/gitpython-developers/GitPython/releases/tag/3.1.47
github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4
nvd.nist.gov/vuln/detail/CVE-2026-42215

Code Behaviors & Features

Detect and mitigate CVE-2026-42215 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →