CVE-2026-42215

A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments (kwargs) to functions such as Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(). This bypasses existing security checks designed to block dangerous Git options, enabling the execution of unauthorized commands.

This is an Important arbitrary command execution flaw in GitPython, a library utilized across several Red Hat products. The vulnerability arises from an incomplete security check that allows specially crafted Python keyword arguments, such as upload_pack or receive_pack, to bypass intended safeguards against dangerous Git options. This bypass enables an attacker to execute arbitrary commands on systems where applications process untrusted input through GitPython's repository interaction functions, potentially leading to system compromise, credential theft, or unauthorized data modification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.