PT-2026-114171 · Gitpython Developers+1 · Gitpython
CVSS v4.0
7.7
High
| Vector | AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
GitPython versions prior to 3.2.0
Description
Remote code execution is possible because
Git.ls remote forwards URLs without performing check unsafe protocols validation. This allows attackers to execute commands by supplying ext:: remote-helper URLs when git permits the ext transport. Additionally, merge base and IndexFile.move are susceptible to unguarded option injection.Recommendations
Update GitPython to version 3.2.0 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitpython