GitPython: Command injection via Git options bypass
Priority HIGH 73CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 16 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.
Summary
GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00749 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial GitPython (gitpython-developers): 3.1.47GitPython (PyPI): 3.1.47Red Hat: 17 advisoriesRed Hat: 16 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gitpython-developers | GitPython | 3.1.30 to before 3.1.47 | 3.1.47 | Patch available | CNA |
| — | GitPython (PyPI) | 3.1.30 to before 3.1.47 | 3.1.47 | Patch available | GHSA-rpm5-65cw-6hj4 |
- GitPython Vendorgitpython-developers Affected 3.1.30 to before 3.1.47 Fixed in 3.1.47 Patch available CNA
- GitPython (PyPI) Vendor— Affected 3.1.30 to before 3.1.47 Fixed in 3.1.47 Patch available GHSA-rpm5-65cw-6hj4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* | 3.1.30 to before 3.1.47 | Vulnerable | gitpython-developers |
- cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* Versions 3.1.30 to before 3.1.47 Vulnerable ·gitpython-developers
Remediation
- Fix · CNA GitPython (gitpython-developers) Fixed in 3.1.47
- Fix · GHSA-rpm5-65cw-6hj4 GitPython (PyPI) Fixed in 3.1.47 Advisory →
Red Hat 17 advisories
- RHSA-2026:74506 Released 2026-10-01 · Red Hat rating CriticalSatellite 6.16.14 Async Update
- Red Hat Satellite 6.16 for RHEL 8 foreman-3.12.0.23-1.el8sat, foreman-cli-3.12.0.23-1.el8sat, foreman-debug-3.12.0.23-1.el8sat +32
- Red Hat Satellite 6.16 for RHEL 9 foreman-3.12.0.23-1.el9sat, foreman-cli-3.12.0.23-1.el9sat, foreman-debug-3.12.0.23-1.el9sat +32
- RHSA-2026:74505 Released 2026-10-01 · Red Hat rating CriticalSatellite 6.17.12 Async Update
- Red Hat Satellite 6.17 for RHEL 9 foreman-3.14.0.22-1.el9sat, foreman-cli-3.14.0.22-1.el9sat, foreman-debug-3.14.0.22-1.el9sat +31
- RHSA-2026:74504 Released 2026-10-01 · Red Hat rating CriticalSatellite 6.18.10 Async Update
- Red Hat Satellite 6.18 for RHEL 9 foreman-3.16.0.25-1.el9sat, foreman-cli-3.16.0.25-1.el9sat, foreman-debug-3.16.0.25-1.el9sat +26
Show 14 more Red Hat advisories
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:71210 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8 +4
- RHSA-2026:71179 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
- RHSA-2026:68780 Released 2026-09-17 · Red Hat rating CriticalTechnical preview of the satellite/iop-vmaas-rhel9 container image
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9
- RHSA-2026:68776 Released 2026-09-17 · Red Hat rating Criticalsatellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
- RHSA-2026:68771 Released 2026-09-17 · Red Hat rating Criticalsatellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
- RHSA-2026:68764 Released 2026-09-17 · Red Hat rating CriticalTechnical preview of the satellite/iop-vmaas-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vmaas-rhel9
- RHSA-2026:67279 Released 2026-09-14 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +7
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:63385 Released 2026-09-03 · Red Hat rating ImportantSatellite 6.19.4 Async Update
- Red Hat Satellite 6.19 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:42132 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
- RHSA-2026:42079 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 ansible-core-2:2.16.19-1.el10ap, receptor-1.6.6-1.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, automation-controller-venv-tower-4.7.14-3.el9ap, automation-gateway-proxy-2.6.17-1.el9ap +5
- RHSA-2026:42078 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.19-1.el8ap, ansible-test-1:2.16.19-1.el8ap, automation-controller-4.6.30-2.el8ap +24
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, ansible-test-1:2.16.19-1.el9ap, automation-controller-4.6.30-2.el9ap +24
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.5 | Fixed | RHSA-2026:71210 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:42132, RHSA-2026:71179 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:42079 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:67279 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:73987 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520 |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2026:74506 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2026:74506 |
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2026:74505 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:68764, RHSA-2026:68771 |
| Red Hat Satellite 6.18 for RHEL 9 | Fixed | RHSA-2026:74504 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:68776, RHSA-2026:68780 |
| Red Hat Satellite 6.19 for RHEL 9 | Fixed | RHSA-2026:63385 |
Not affected: 26 products
- Migration Toolkit for Applications 8
- Pen Drive Powered by Red Hat Lightspeed
- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Ansible Automation Platform 2.7
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat Satellite 6.19 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42215
- 2026-10-03 Alias added: GHSA-rpm5-65cw-6hj4
- 2026-10-06 Fix available: RHSA-2026:74504 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:74506 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:74505 · Red Hat
- 2026-10-06 Fix available: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9 +1 · Red Hat
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
References
More gitpython-developers Gitpython vulnerabilities
- TI-2026-54689 GitPython before 3.1.59 Path Traversal via separate-git-dir CVSS 4.0HIGH 8.7
- TI-2026-51706 GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() CVSS 4.0HIGH 8.7
- TI-2026-47618 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from CVSS 4.0HIGH 8.7
- TI-2026-30595 GitPython: Unsafe option check validates multi_options before shlex.split transforms it CVSS 3.1CRITICAL 9.8
- TI-2026-32220 GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository CVSS 4.0HIGH 7.8
- TI-2026-47621 GitPython before 3.1.51 Command Injection via option prefix abbreviation CVSS 4.0HIGH 8.7
Sources
- CVE-2026-42215 · CVE Program
- CVE-2026-42215 · NVD
- FIRST EPSS
- GHSA-rpm5-65cw-6hj4 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-42215 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences