Is CVE-2026-42215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42215 being exploited in the wild.

How severe is CVE-2026-42215?

High severity, with a CVSS score of 8.8, published 7 May 2026.

Which products and versions are affected?

gitpython (PyPI) ECOSYSTEM:introduced=3.1.30,fixed=3.1.47.

Is there a fix for CVE-2026-42215?

Yes. gitpython (PyPI): upgrade to 3.1.47 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42215 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42215?

Check whether you run Gitpython Project Gitpython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42215: GitPython command injection via keyword argument bypass

CVE-2026-42215 · Severity: high · CVSS 8.8 · Published 2026-05-07

GitPython is a popular Python library used by developers to interact with Git repositories. A security flaw allows an attacker to execute arbitrary commands on the system running the library if the application passes user-controlled input into certain repository functions. This could lead to full system compromise, unauthorized data access, or service disruption.

Technologies: Gitpython Project Gitpython, gitpython (PyPI). Vendors: Gitpython Project, PyPI.

Quick answers

Is CVE-2026-42215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42215 being exploited in the wild.
How severe is CVE-2026-42215?: High severity, with a CVSS score of 8.8, published 7 May 2026.
Which products and versions are affected?: gitpython (PyPI) ECOSYSTEM:introduced=3.1.30,fixed=3.1.47.
Is there a fix for CVE-2026-42215?: Yes. gitpython (PyPI): upgrade to 3.1.47 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42215 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42215?: Check whether you run Gitpython Project Gitpython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

gitpython (PyPI): upgrade to 3.1.47 or later
```
pip install "gitpython>=3.1.47"
```

Technical details

GitPython contains a command injection vulnerability due to an incomplete blacklist check for dangerous Git options. While the library explicitly blocks hyphenated options like '--upload-pack' via Git.check_unsafe_options(), it fails to validate the equivalent Python keyword arguments (kwargs) that use underscores (e.g., 'upload_pack'). These underscored kwargs are later normalized into dangerous dashified Git flags during command execution. An attacker who can control the kwargs passed to Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push() can execute arbitrary shell commands even if 'allow_unsafe_options' is set to False. This issue is resolved in version 3.1.47.

Affected products

gitpython-developers GitPython >= 3.1.30, < 3.1.47

Identifiers

CVE-2026-42215
GHSA-rpm5-65cw-6hj4
PYSEC-2026-2160

Timeline

2026-04-22: advisory: Internal advisory published by maintainers
2026-04-25: patched: Version 3.1.47 released
2026-05-07: disclosed: CVE-2026-42215 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.