high7.5
CVE-2026-110857
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_u…
Impact
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.
Affected products
| Product | Affected versions |
|---|---|
| GitPython | before 3.2.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.