PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110857 gitpython-developers CVE debrief

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. This vulnerability affects GitPython deployments, particularly those using ext:: URLs in Git.ls_remote. Defenders should assess exposure and prioritize verification and remediation efforts to prevent potential command execution attacks. The vulnerability is caused by the lack of validation for check_unsafe_protocols in Git.ls_remote, which allows attackers to supply ext:: remote-helper URLs to execute commands when git permits the ext transport.

Vendor
gitpython-developers
Product
GitPython
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-15
Advisory published
2026-10-14
Advisory updated
2026-10-15

Who should care

Defenders responsible for GitPython deployments should assess exposure and prioritize verification and remediation efforts to prevent potential command execution attacks. This includes verifying GitPython versions, restricting ext:: URL usage, and monitoring for suspicious activity related to GitPython. Security teams and vulnerability management teams should also prioritize remediation efforts to prevent potential exploits.

Why it matters

Defenders should prioritize verifying GitPython versions and restricting ext:: URL usage to prevent command execution attacks.

  • Verify and upgrade GitPython versions to prevent command execution
  • Restrict ext:: URL usage to mitigate vulnerability
  • Monitor for suspicious activity related to GitPython

Technical summary

The vulnerability allows attackers to execute commands via ext:: URLs in Git.ls_remote, affecting GitPython before 3.2.0. This is due to the lack of check_unsafe_protocols validation in Git.ls_remote. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport. The vulnerability impacts GitPython deployments, particularly those using ext:: URLs in Git.ls_remote. Defenders should prioritize verifying GitPython versions and restricting ext:: URL usage to prevent command execution attacks.

Defensive priority

Defenders should prioritize verifying GitPython versions and restricting ext:: URL usage.

Recommended defensive actions

  • Verify GitPython versions and upgrade to 3.2.0 or later
  • Restrict usage of ext:: URLs in Git.ls_remote
  • Monitor for suspicious activity related to GitPython
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information on exploitation or impact. Defenders should verify GitPython versions and restrict ext:: URL usage to prevent command execution attacks. The vulnerability allows attackers to execute commands via ext:: URLs in Git.ls_remote, affecting GitPython before 3.2.0. Limited information is available on potential exploits or affected systems.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110857 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110857

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110857 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110857

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110857.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-w8jc-g24h-crhw

    Supplemental source - vendor-advisory

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/gitpython-before-3.2.0-command-execution-via-ls-remote-ext-urls

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.