CVE-2026-42215: 
Python vulnerability analysis and mitigation

CVE-2026-42215 is a command injection vulnerability in GitPython, a Python library for interacting with Git repositories, caused by a bypass of the built-in unsafe Git option guard via underscore-form Python kwargs. Affected versions span from 3.1.30 to before 3.1.47; the issue was disclosed on April 22, 2026, and patched in version 3.1.47 released April 25, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, GitPython Release).

The root cause (CWE-78: OS Command Injection) lies in a normalization gap in GitPython's unsafe-option validation logic. Git.check_unsafe_options() in git/cmd.py blocks dangerous Git flags like --upload-pack and --receive-pack by checking raw kwarg names before they are transformed into command-line flags. However, Git.transform_kwarg() later converts Python underscore-form kwargs (e.g., upload_pack) into their hyphenated Git flag equivalents (e.g., --upload-pack), meaning the safety check never sees the normalized form. As a result, calling remote.fetch(upload_pack=<attacker_value>) bypasses the guard that correctly blocks remote.fetch(**{"upload-pack": <attacker_value>}). This bypass applies to Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push(), and requires only that an attacker control a kwarg value passed to one of these methods (GitHub Advisory).

Successful exploitation allows an authenticated attacker with control over kwargs passed to GitPython repository operations to execute arbitrary OS commands as the process running the application. High-risk targets include web applications accepting user-configured repository import/sync settings, CI/CD pipelines that build GitPython calls from untrusted YAML/JSON configs, and automation bots that expose these kwargs across a trust boundary. Consequences include theft of SSH keys, deploy credentials, API tokens, and cloud credentials; modification of repositories or build artifacts; lateral movement from CI/CD workers; and full compromise of the affected service process (GitHub Advisory).

A complete, runnable proof-of-concept (PoC) Python script is publicly available in the GitHub Security Advisory, demonstrating arbitrary command execution by bypassing GitPython's unsafe option validation through underscore-form kwargs. The PoC uses remote.fetch(upload_pack=wrapper) to execute an attacker-controlled shell script and capture proof of execution (id, whoami, cwd, environment variables). As of the time of reporting, there is no evidence of in-the-wild exploitation, and the vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.091% (GitHub Advisory).

1. Identify a vulnerable target: Find an application using GitPython versions 3.1.30–3.1.46 that passes user-controlled input as kwargs to Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push() — common in web-based repo import/sync features, CI/CD systems, or automation bots.
2. Craft a malicious helper script: Prepare an attacker-controlled executable (e.g., a shell script) that performs the desired action — such as exfiltrating credentials, writing a file, or establishing a reverse shell — and then calls the legitimate git-upload-pack "$@" to avoid raising errors.
3. Inject via underscore-form kwarg: Supply the path to the malicious helper as the upload_pack (or receive_pack for push) kwarg, e.g., remote.fetch(upload_pack="/path/to/malicious_wrapper.sh"). The hyphenated form {"upload-pack": ...} would be blocked, but the underscore form bypasses the check.
4. Trigger execution: When the application invokes the GitPython method with the attacker-controlled kwarg, GitPython normalizes upload_pack to --upload-pack and passes the attacker's script as the upload-pack helper to Git, causing it to execute with the privileges of the application process.
5. Collect results: The attacker-controlled script runs, capturing environment variables (including potential secrets like GITHUB_TOKEN, AWS_*, SSH_AUTH_SOCK), identity information, and performing any further malicious actions (GitHub Advisory).

• Process: Unexpected child processes spawned by a Python/GitPython process, such as shell scripts, id, whoami, curl, wget, or SSH processes not associated with normal Git operations.
• File System: Unexpected files written by the application process (e.g., proof files, web shells, or modified build artifacts); new or modified scripts in temp directories (e.g., /tmp/gp-poc-*) created by the application user.
• Logs: Application logs showing Git operations (fetch, pull, push, clone) with unusual --upload-pack or --receive-pack arguments pointing to non-standard executables; Python tracebacks or unexpected UnsafeOptionError exceptions in logs (indicating probing of the blocked hyphenated form).
• Network: Unexpected outbound connections from the application server to attacker-controlled hosts, particularly originating from the Git subprocess; unusual SSH connections initiated by the application process user (GitHub Advisory).

Upgrade GitPython to version 3.1.47 or later, which includes a fix (PR #2131) that blocks unsafe underscore-form kwargs by normalizing them before the safety check is applied (GitPython Release). As a workaround for applications that cannot immediately upgrade, audit all code paths that pass dynamic or user-controlled kwargs to Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), and implement strict allowlisting of permitted kwargs before passing them to GitPython. Do not rely on GitPython's allow_unsafe_options=False default as a security boundary when user input can influence kwarg names or values (GitHub Advisory).

The vulnerability was reported by researcher WesR and published as GitHub Security Advisory GHSA-rpm5-65cw-6hj4. Distribution-level advisories were issued for Fedora, openSUSE, and Ubuntu (USN-8303-1), and the issue was picked up by Linux security news outlets including linuxsecurity.com and pro-linux.de. Social media discussion appeared on Bluesky and Mastodon shortly after disclosure, and the vulnerability was indexed by Nessus (plugin 314600) and Qualys scanners (GitHub Advisory, GitPython Release).