High severity8.1NVD Advisory· Published Oct 14, 2026

CVE-2026-110858

Description

GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack= to execute OS commands as the calling process over local-path or SSH transports.

Affected products

Gitpython Project/Gitpythonllm-create
Range: <3.2.0

Patches

Vulnerability mechanics

References

github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239nvd
www.vulncheck.com/advisories/gitpython-3.1.30-before-3.2.0-command-injection-via-remote-pull-refspecnvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000