GitPython Command Wrappers Omit Unsafe Protocol And Option Checks

Summary GitPython has spent 2022-2026 rolling out two reusable guards method-by-method: "Git.checkunsafeprotocolsurl" raises "UnsafeProtocolError" for "::" remote-helper URLs - CVE-2022-24439 and "Git.checkunsafeoptions..." raises "UnsafeOptionError" for denylisted option spellings -...

GitPython command wrappers omit unsafe protocol and option checks

Summary GitPython has spent 2022-2026 rolling out two reusable guards method-by-method: Git.checkunsafeprotocolsurl raises UnsafeProtocolError for :: remote-helper URLs - CVE-2022-24439 and Git.checkunsafeoptions... raises UnsafeOptionError for denylisted option spellings - CVE-2023-40267,...

GHSA-W8JC-G24H-CRHW GitPython command wrappers omit unsafe protocol and option checks

Summary GitPython has spent 2022-2026 rolling out two reusable guards method-by-method: Git.checkunsafeprotocolsurl raises UnsafeProtocolError for :: remote-helper URLs - CVE-2022-24439 and Git.checkunsafeoptions... raises UnsafeOptionError for denylisted option spellings - CVE-2023-40267,...

GitPython Git ls_remote Code Execution

The vulnerability of the Git.lsremote method in the Python library for interacting with Git repositories in GitPython is related to incorrect checking of the specified data type. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

SUSE CVE-2026-110857

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

Improper Validation of Specified Type of Input

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via Git.lsremote forwarding caller-supplied URLs without checkunsafeprotocols validation. An attacker who controls the U...

EUVD-2026-101740

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

UBUNTU-CVE-2026-110857

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

Linux Distros Unpatched Vulnerability : CVE-2026-110857

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without...

CVE-2026-110857

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

DEBIAN-CVE-2026-110857

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

CVE-2026-110857

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

CVE-2026-110857

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

CVE-2026-110857

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

CVE-2026-110857: Improper Validation of Specified Type of Input

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

CVE-2026-67323

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote, allowing command injection via options such as --exec/--upload-pack leading to arbitrary command execution. Additionally, Repo.itercommits and Repo.blame do not check...

CVE-2026-67323: Improper Neutralization of Special Elements used in a Command

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote, allowing command injection via options such as --exec/--upload-pack leading to arbitrary command execution. Additionally, Repo.itercommits and Repo.blame do not check...