CVE-2026-110858 gitpython-developers CVE debrief

Who should care

Developers and administrators using GitPython 3.1.30 before 3.2.0 should assess their exposure and take necessary actions to mitigate the vulnerability. This includes updating to version 3.2.0 or later, restricting access to affected systems, and monitoring for suspicious activity. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and take necessary actions to protect their systems.

Why it matters

CVE-2026-110858 is a critical vulnerability in GitPython that allows remote code execution via command injection. Developers and administrators should update to version 3.2.0 or later and restrict access to affected systems.

• Remote code execution is possible via specially crafted refspecs
• Attackers can execute OS commands as the calling process
• Local-path and SSH transports are affected

Technical summary

The vulnerability exists in the Remote.pull() method of GitPython, where the unsafe-option guard only inspects keyword arguments, not the positional refspec. This allows attackers to supply malicious refspecs that can lead to command injection. The vulnerability can be exploited over local-path or SSH transports, potentially leading to unauthorized access and control of affected systems. Developers and administrators should update to version 3.2.0 or later and restrict access to affected systems to mitigate the vulnerability.

Defensive priority

High

Recommended defensive actions

• Update GitPython to version 3.2.0 or later
• Restrict access to the affected systems
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in GitPython 3.1.30 before 3.2.0. The NVD entry is currently not provided. Evidence of the vulnerability's existence and impact is based on the information available from the CVE Program and source item. Defenders should verify the affected scope, severity, and vendor guidance to assess their exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.