CVE-2026-110857: GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while mergebase and IndexFile.move also accept unguarded option injection.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Applications using GitPython before 3.2.0 are exposed if they pass attacker-controlled remote URLs to Git.ls_remote and the underlying Git configuration permits the ext transport. The listed issue also affects code paths that pass untrusted input to merge_base or IndexFile.move.
What must an attacker provide to execute commands through ls_remote?
An attacker must be able to supply an ext:: remote-helper URL to Git.ls_remote. Exploitation also depends on Git permitting the ext transport, and the vulnerability’s vector indicates user interaction is required.
Does this affect every GitPython deployment by default?
The provided information does not establish that every default deployment permits the ext transport. Exposure through ls_remote is conditional on Git allowing ext transport and on the application accepting attacker-controlled remote URLs.
What is the remediation?
Upgrade GitPython to version 3.2.0 or later. Until upgrading, do not pass untrusted URLs to Git.ls_remote and avoid passing untrusted values to merge_base or IndexFile.move.