Zero Radar
← feed
HighVulnerabilityGHSA-f9j4-qggq-h239updated 27 Oct 2026, 15:28 UTC

GitPython: remote pull can run attacker-supplied commands

If an app passes user-controlled text into GitPython's pull function, an attacker can sneak in a hidden command that the computer then runs. The attacker can get the same control over the machine as the app itself.

Fixed in GitPython 3.2.0Official source
SeverityHighCVSS 8.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesGitPython 3.2.0 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker crafts inputOption-shaped value like --upload-pack=cmd
  2. 2App passes it as refspecPositional argument skips the safety check
  3. 3git pull runs with optionForwarded to internal git fetch
  4. 4Command executesRuns as upload-pack over local or SSH transport
  5. ResultAttacker runs commands on the server

What happened

Remote.pull() forwards its positional refspec argument to git pull without the unsafe-option check that only covers keyword arguments, so an option-shaped value such as --upload-pack=<command> is executed for local-path or SSH transports.

Why it is dangerous: Anyone able to influence the refspec value in a web or CI service using GitPython can run arbitrary OS commands with the process's privileges, without user interaction, on default settings.

Are you affected?

You are affected if you use GitPython 3.1.30 up to (not including) 3.2.0, call Remote.pull() with attacker-influenced refspec input, and pull from local-path or SSH remotes.

Package / productAffected versionsFixed in
GitPython · pip>= 3.1.30, < 3.2.03.2.0

What to do

  1. Upgrade GitPython to 3.2.0 or later (pip install --upgrade GitPython)
  2. Until upgraded, never pass user-supplied or untrusted text as the refspec argument to Remote.pull()
  3. Validate or allowlist branch and refspec inputs in any web or CI service that uses GitPython

Timeline

  1. 27 Oct 2026, 15:26 UTC
    Publicly disclosed
  2. 27 Oct 2026, 15:26 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 15:28 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-f9j4-qggq-h239
CVSS
8.1 / 10
Disclosed
27 Oct 2026, 15:26 UTC
On Zero Radar
27 Oct 2026, 15:28 UTC (2 min after disclosure)
Last change
27 Oct 2026, 15:28 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

GitPython: remote pull can run attacker-supplied commands · Zero Radar