CVE-2026-42215 json
GitPython: Command injection via Git options bypass
published 2026-04-25 6 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-28411 , GHSA-rpm5-65cw-6hj4 , PYSEC-2026-2160
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.
Patch / fix
- pypi gitpython 3.1.47
- gitpython_project gitpython 3.1.47
- python-git Debian 12 3.1.30-1+deb12u3
- python-git Debian 13 3.1.44-1+deb13u1
- python-git Debian 14 3.1.50-1
debian advisories DEBIAN-CVE-2026-42215
- python-git Ubuntu Pro 14.04 LTS 0.3.2~RC1-3ubuntu0.1~esm3
- python-git Ubuntu Pro 16.04 LTS 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4
- python-git Ubuntu Pro 18.04 LTS 2.1.8-1ubuntu0.1~esm4
- python-git Ubuntu Pro 20.04 LTS 3.0.7-1ubuntu0.1~esm4
- python-git Ubuntu Pro 22.04 LTS 3.1.24-1ubuntu0.1~esm3
- python-git Ubuntu Pro 24.04 LTS 3.1.37-3ubuntu0.1~esm2
- python-git Ubuntu Pro 26.04 LTS 3.1.46-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2026-42215
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- foreman satellite utils 6.17, satellite capsule 6.17, satellite 6.17 3.14.0.22-1.el9sat
- satellite satellite utils 6.17, satellite capsule 6.17, satellite 6.17 6.17.12-1.el9sat
- foreman-cli satellite utils 6.17, satellite 6.17 3.14.0.22-1.el9sat
- foreman-ec2 satellite 6.17 3.14.0.22-1.el9sat
- foreman-pcp satellite capsule 6.17, satellite 6.17 3.14.0.22-1.el9sat
- python-lxml satellite capsule 6.17, satellite 6.17 5.3.1-2.el9pc
- foreman-ovirt satellite 6.17 3.14.0.22-1.el9sat
- foreman-redis satellite 6.17 3.14.0.22-1.el9sat
red hat advisories RHSA-2026:74505RHSA-2026:74504RHSA-2026:74506RHSA-2026:63385RHSA-2026:42079RHSA-2026:42078
- python-GitPython SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 3.1.34.1693646983.2a2ae77-150400.9.8.1
suse advisories SUSE-SU-2026:4072-1
- python-GitPython openSUSE Tumbleweed 3.1.49-1.1
opensuse advisories openSUSE-SU-2026:10758-1
- py3-gitpython Alpine 3.24, Alpine 3.23 3.1.49-r0
alpine advisories ALPINE-CVE-2026-42215
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-42215 updated cvss 7.5
GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks
-
Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9affected: workaround, no fix available
-
Red Hat AI Inference Server rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-24/controller-rhel8affected: workaround, no fix planned “Will not fix”
-
Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9affected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Satellite 6 python-gitpythonaffected: workaround, no fix available
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/controller-rhel8 1789607021fixed: vendor fix RHSA-2026:71210
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-gitpython 3.1.50-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-gitpython 3.1.50-1.el9apfixed: vendor fix RHSA-2026:42078
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1783979593, ansible-automation-platform-26/hub-rhel9 1789611274, ansible-automation-platform-26/controller-rhel9 1789673739fixed: vendor fix RHSA-2026:71179
-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-gitpython 3.1.50-1.el9apfixed: vendor fix RHSA-2026:42079
show 12 moreshow fewer
-
Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1788918708, ansible-automation-platform-27/controller-rhel9 1788918363fixed: vendor fix RHSA-2026:67279
-
Red Hat OpenShift AI 2.25 rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 1788185839, rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 1788185798, rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 1788185733, rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 1788185436, rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 1788185848, rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 1788185899, +4 morefixed: vendor fix RHSA-2026:65126
-
Red Hat OpenShift AI 3.3 rhoai/odh-training-cuda128-torch29-py312-rhel9 1789492653, rhoai/odh-trustyai-nemo-guardrails-server-rhel9 1789570674, rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 1790260954, rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 1790072130, rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 1790072109, rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 1789651387, +6 morefixed: vendor fix RHSA-2026:73987
-
Red Hat OpenShift AI 3.4 rhoai/odh-th06-cpu-torch210-py312-rhel9 1787076778, rhoai/odh-th06-rocm64-torch291-py312-rhel9 1787076481, rhoai/odh-th06-cuda130-torch210-py312-rhel9 1787077779, rhoai/odh-training-cuda128-torch29-py312-rhel9 1786611803, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1787073873, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 1787073611, +14 morefixed: vendor fix RHSA-2026:60520
-
Red Hat Satellite 6.16 for RHEL 8 python-lxml 4.9.2-5.el8pc, foreman 3.12.0.23-1.el8sat, satellite 6.16.14-1.el8sat, python-sqlparse 0.6.0-1.el8pc, python3.11-lxml 4.9.2-5.el8pc, foreman-cli 3.12.0.23-1.el8sat, +28 more Red Hat Satellite 6.16 for RHEL 9 python-lxml 4.9.2-5.el9pc, foreman 3.12.0.23-1.el9sat, satellite 6.16.14-1.el9sat, python-sqlparse 0.6.0-1.el9pc, python3.11-lxml 4.9.2-5.el9pc, foreman-cli 3.12.0.23-1.el9sat, +28 morefixed: vendor fix RHSA-2026:74506
-
Red Hat Satellite 6.17 for RHEL 9 python-lxml 5.3.1-2.el9pc, foreman 3.14.0.22-1.el9sat, satellite 6.17.12-1.el9sat, python-sqlparse 0.6.0-1.el9pc, python3.11-lxml 5.3.1-2.el9pc, foreman-cli 3.14.0.22-1.el9sat, +27 morefixed: vendor fix RHSA-2026:74505
-
Red Hat Satellite 6.18 satellite/iop-vmaas-rhel9 1789611858, satellite/iop-vulnerability-engine-rhel9 1789637082fixed: vendor fix RHSA-2026:68764
-
Red Hat Satellite 6.18 for RHEL 9 foreman 3.16.0.25-1.el9sat, satellite 6.18.10-1.el9sat, foreman-cli 3.16.0.25-1.el9sat, foreman-ec2 3.16.0.25-1.el9sat, foreman-pcp 3.16.0.25-1.el9sat, satellite-cli 6.18.10-1.el9sat, +22 morefixed: vendor fix RHSA-2026:74504
-
Red Hat Satellite 6.19 satellite/iop-vmaas-rhel9 1789611998, satellite/iop-vulnerability-engine-rhel9 1789607605fixed: vendor fix RHSA-2026:68780
-
Red Hat Satellite 6.19 for RHEL 9 python3.12-gitpython 3.1.59-1.el9pcfixed: vendor fix RHSA-2026:63385
-
Red Hat Migration Toolkit for Applications 8 mta/mta-solution-server-rhel9not affected: component not present
-
Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9 Red Hat AI Inference Server rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9 Red Hat Ansible Automation Platform 2 python-gitpython, automation-controller, python3x-gitpython 3.1.40-1.el8ap, python3.11-gitpython 3.1.41-1.el9ap, ansible-automation-platform-25/hub-rhel8 Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-rhel8 1789606395, ansible-automation-platform-25/gateway-rhel8 1789605572, ansible-automation-platform-25/hub-web-rhel8 1789690469, ansible-automation-platform-25/receptor-rhel8 1789590330, ansible-automation-platform-25/de-minimal-rhel8 1789634812, ansible-automation-platform-25/ee-minimal-rhel8 1789652412, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.6-1.el8ap, receptorctl 1.6.6-1.el8ap, ansible-core 2.16.19-1.el8ap, ansible-test 2.16.19-1.el8ap, automation-hub 4.10.16-1.el8ap, python3.12-pyjwt 2.13.0-1.el8ap, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.6-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-core 2.16.19-1.el9ap, ansible-test 2.16.19-1.el9ap, automation-hub 4.10.16-1.el9ap, python3.12-pyjwt 2.13.0-1.el9ap, +20 morenot affected: vulnerable code not present
+12 more productsfewer
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1783969842, ansible-automation-platform-26/gateway-rhel9 1789666472, ansible-automation-platform-26/hub-web-rhel9 1783982443, ansible-automation-platform-26/hub-web-rhel9 1789615881, ansible-automation-platform-26/receptor-rhel9 1783962464, ansible-automation-platform-26/receptor-rhel9 1789610120, +53 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.6-1.el9ap, molecule 26.6.0-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-sign 0.1.6-1.el9ap, ansible-lint 26.6.0-1.el9ap, ansible-core 2.16.19-1.el9ap, +39 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.6-1.el10ap, molecule 26.6.0-1.el10ap, receptorctl 1.6.6-1.el10ap, ansible-sign 0.1.6-1.el10ap, ansible-lint 26.6.0-1.el10ap, ansible-core 2.16.19-1.el10ap, +9 more Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/gateway-rhel9 1788918510, ansible-automation-platform-27/hub-web-rhel9 1788924567, ansible-automation-platform-27/receptor-rhel9 1788918370, ansible-automation-platform-27/mcp-tools-rhel9 1788917342, ansible-automation-platform-27/de-minimal-rhel9 1788920534, ansible-automation-platform-27/ee-minimal-rhel9 1788901236, +24 more Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, python3, tkinter, python-libs, python-test, python-tools, +4 more Red Hat Enterprise Linux 8 numpy, scipy, PyYAML, python3, mod_wsgi, python36, +89 more Red Hat Enterprise Linux 9 python3, python3.9, python3.11, python3.12, python3.14, python3-idle, +21 more Red Hat Enterprise Linux 10 python3.12, python3.14 Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/bootc-azure-cuda-rhel9, rhelai3/bootc-azure-rocm-rhel9 Red Hat Hardened Images llvm, rust, llvm21, swift-lang Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-feature-server-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhoai/odh-th06-cuda130-torch291-py312-rhel9
7 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | gitpython | >=3.1.30, <3.1.47 |
3.1.47 |
Affected products
- gitpython-developers GitPython
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/gitpython-developers/GitPython/releases/tag/3.1.47
web, patch, release-notes
-
github.com
/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4
exploit, web, vendor-advisory, evidence
-
nvd.nist.gov
/vuln/detail/CVE-2026-42215
advisory
-
github.com
/gitpython-developers/GitPython
package
Sources
- CVE List CVE-2026-42215
- GitHub Advisory GHSA-rpm5-65cw-6hj4
- NVD CVE-2026-42215
- OSV PYSEC-2026-2160
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.