MinorCritical vulnerability

CVE-2026-110857 (CVSS 7.7)

NVD · officialPublished Oct 14, 2026Risk 23/100EPSS 0.4%

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.

Technical details

CVSS

7.7

AV:NetworkAC:HighPR:NoneUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source