Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-110857— GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs

Quick assessment

Affected

gitpython-developers GitPython

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GitPython 3.2.0 之前的版本中存在一个远程代码执行漏洞，攻击者可以利用该漏洞在服务器上执行任意命令。这是因为 Git.ls_remote 函数在未通过 check_unsafe_protocols 验证的情况下，直接转发了外部提供的 URL。当 Git 允许使用 ext 传输协议时，攻击者可以通过提供 ext:: 远程辅助工具 URL 来触发命令执行。此外，merge_base 和 IndexFile.move 方法也存在类似的未受保护的选项注入漏洞，可能导致恶意代码执行。

CVSS 7.5 · High EPSS 0.42% · P34 Updated Oct 15, 2026

Possible ATT&CK Techniques 3 AI

T1203 · Exploitation for Client Execution T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
gitpython-developers	GitPython	`< 3.2.0`	affected
		`3.2.0`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs

Source: CVE Program / CVE List V5

Vulnerability Description

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1287

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
gitpython-developers	GitPython	0 ~ 3.2.0	-

II. Public POCs for CVE-2026-110857

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-110857

请登录查看更多情报信息。

Other References for CVE-2026-110857 (2)

https://www.cve.org/CVERecord?id=CVE-2026-110857

Same Patch Batch · gitpython-developers · 2026-10-14 · 6 CVEs total

CVE-2026-110858	8.1 HIGH	GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
CVE-2026-110856	7.5 HIGH	GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date
CVE-2026-110859	7.5 HIGH	GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name
CVE-2026-110855	6.5 MEDIUM	GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name
CVE-2026-110860	6.1 MEDIUM	GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()

IV. Related Vulnerabilities

Same product: GitPython

Same vendor: gitpython-developers

Same weakness: CWE-1287

V. Comments for CVE-2026-110857

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-110857— GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs

Quick assessment

Possible ATT&CK Techniques 3 AI

Affected Version Matrix 2

I. Basic Information for CVE-2026-110857

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-110857

III. Intelligence Information for CVE-2026-110857

Other References for CVE-2026-110857 (2)

Same Patch Batch · gitpython-developers · 2026-10-14 · 6 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-110857

Leave a comment