CVE-2026-42284

A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the _clone() function. By crafting a malicious string in the multi_options parameter, an attacker could bypass validation. This allows for the injection of arbitrary Git configurations, such as core.hooksPath, leading to the execution of attacker-controlled hooks and ultimately, arbitrary code execution during a clone operation.

This Important vulnerability in GitPython allows for arbitrary code execution during Git clone operations within Red Hat products that utilize the library. The flaw stems from insufficient validation of user-supplied input to the _clone() function, enabling an attacker to inject malicious Git configurations, such as core.hooksPath, and execute arbitrary code. Exploitation requires an application to process untrusted input through GitPython's cloning functionalities.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.