CVE-2026-42284

9.8 Critique

Publiée le 07/05/2026 à 21:16 · Modifiée le 17/06/2026 à 12:47 · Modifiée · Source : security-advisories@github.com

Description

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options)). A string like "--branch main --config core.hooksPath=/x" passes validation (starts with --branch), but after split becomes ["--branch", "main", "--config", "core.hooksPath=/x"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
3.1	9.8 Critique	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-88

Références

https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47 PatchRelease Notes
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485 ExploitVendor Advisory
https://www.tenable.com/cve/CVE-2026-32686

CVE-2026-42284

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs