Bug 2552959 (CVE-2026-110858)
| Summary: | CVE-2026-110858 GitPython: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | unspecified | CC: | alinfoot, anthomas, bbrownin, dschmidt, dtrifiro, eglynn, ehelms, gbenhaim, ggainey, ikhan, ilpinto, jdobes, jjoyce, jlanda, jmitchel, jpasqual, jpretori, jschluet, juwatts, kaycoth, kshier, lhh, ltomasbo, mburns, mdellweg, mgarciac, mhulan, niyer, nmoumoul, orabin, osousa, pcreech, rbobbitt, rchan, simaishi, smallamp, stcannon, tmalecek, twaugh, weaton, yguenane, ykashtan |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in GitPython. This vulnerability allows an attacker to achieve arbitrary code execution on the host system. The issue occurs because the Remote.pull() function inspects only keyword arguments for unsafe command options and fails to validate positional repository reference specifications (refspecs). By supplying crafted refspecs containing command-line flags, an attacker can execute arbitrary operating system commands with the privileges of the calling process.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-14 23:01:29 UTC
|