GitPython Argument Injection Flaws Enable Command Execution via Clone and Remote Operations

Red Hat disclosed two Important GitPython vulnerabilities, CVE-2026-42215 and CVE-2026-42284, that can let attackers achieve arbitrary command execution when applications pass untrusted input into Git operations. CVE-2026-42215 stems from incomplete filtering of dangerous Git options supplied through crafted Python keyword arguments, affecting functions such as Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push(). CVE-2026-42284 affects the _clone() path and allows malicious use of the multi_options parameter to inject Git configuration like core.hooksPath, enabling execution of attacker-controlled hooks during clone operations.

The flaws map to CWE-88 argument injection, a weakness in which applications fail to properly neutralize argument delimiters and unintended options are interpreted by downstream commands. Red Hat assigned both issues a CVSS v3 score of 7.5, while external scoring for CVE-2026-42284 ranged higher, and said no acceptable mitigation is currently available under its product security criteria. Red Hat listed multiple products as affected, with some marked not affected or will not fix, and noted that GitPython 3.1.47 contains the upstream fix for CVE-2026-42215; the disclosures underscore the risk of passing user-controlled values into command or clone parameters without strict validation or argument separation.