---
schema_version: '1.0'
id: security-20260714-a28fde
url: https://osv.dev/vulnerability/PYSEC-2026-2160
url_hash: a28fde6d6771bcc177971229aa3e6e7af3270a7cd53df70fc2c0d10a36a3eeee
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2160
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-42215
- PYSEC-2026-2160
- severity:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- gitpython
- PyPI
lang: en
published_at: '2026-05-07T19:16:01Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:43:41Z'
status: published
content_hash: 00e9e5ed567aff49725a1b66f54483a4910ebdd8e989b1ac7ad7c109585475c0
license_note: full
summary: GitPython is a python library used to interact with Git repositories. From
  version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options
  such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs
  upload_pack and receive_pack bypass tha
summary_source: rss
summary_en: GitPython is a python library used to interact with Git repositories.
  From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options
  such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs
  upload_pack and receive_pack bypass tha
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-42215 — gitpython
---

# CVE-2026-42215 — gitpython

## TL;DR
GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass tha

## Key Points
- cve / CVE-2026-42215 / PYSEC-2026-2160 / severity:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H / gitpython / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
**Advisory:** PYSEC-2026-2160 (CVE-2026-42215)

**Affected (your watchlist):**
- `PyPI:gitpython` 3.1.46 → fixed in 3.1.47 [docker/docker-llmwiki]

**Details:**
GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.

**References:**
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2160_

## Source
元記事: [CVE-2026-42215 — gitpython](https://osv.dev/vulnerability/PYSEC-2026-2160) — published 2026-05-07T19:16:01Z