CVE-2026-110858 — GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional …
Published: 2026-10-14 · CVSS: 9.2 · CVSS 4.0
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7