CVE-2026-42215

GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.

Affected products

Gitpython, Linuxmint, Red Os, Ubuntu

Gitpython Project Gitpython

< 3.1.47

Fix

Available

CVSS 3.1

8.8 HIGH

EPSS

0.7% (51th percentile)

Weakness

CWE-78

NVD status

Analyzed

Published

2026-05-07

No exploit for CVE-2026-42215 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.