Vulnerability in GitPython (CVE-2026-42284)
Summary
Vulnerability in GitPython (CVE-2026-42284). Successful exploitation can lead to full system takeover. Exploitable via multi_options. Mitigation: upgrade to 3.1.47 or later.
Original description
The description as published by the source.
Summary
_clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options)). A string like "--branch main --config core.hooksPath=/x" passes validation (starts with --branch), but after split becomes ["--branch", "main", "--config", "core.hooksPath=/x"]. Git applies the config and executes attacker hooks during clone.
Details
The vulnerable code is in git/repo/base.py line 1383:
multi = shlex.split(" ".join(multi_options))
Then validation runs on the original list at line 1390:
Git.check_unsafe_options(options=multi_options, unsafe_options=cls.unsafe_git_clone_options)
Then execution uses the transformed result at line 1392:
proc = git.clone(multi, "--", url, path, ...)
The check at git/cmd.py line 959 uses startswith:
if option.startswith(unsafe_option) or option == bare_option:
"--branch main --config ..." does not start with "--config", so it passes. After `shlex.s…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-42284 has been found in GitPython.
Attackers can target a specific entry point like multi_options over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 8.1/10.
What to do: upgrade GitPython to 3.1.47 or later.
If unsure, ask your IT team or search "GitPython CVE-2026-42284" on the vendor's site.
CVE-2026-42284 (GitPython) — CWE-88 / CVSS v3 8.1
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: multi_options / startswith / shlex.split / clone_multi_options
Patched: 3.1.47 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-88) exists in GitPython. Attackers reach the vulnerable code path via multi_options without authentication.
Check the vendor advisory for the affected versions of GitPython. Attack surface: multi_options / startswith / shlex.split / clone_multi_options.
Severity: High (CVSS 8.1/10). Successful exploitation can lead to full system takeover.
Update to 3.1.47.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'GitPython' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'GitPython' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
GitPythonを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade GitPython to 3.1.47ステージング環境で 3.1.47 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-42284 python-git
- Ubuntu UBUNTU-CVE-2026-42284 python-git
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web tenable.com
- web github.com