CVE-2026-110858

Executive Summary

CVE-2026-110858 is a remote code execution vulnerability in GitPython versions from 3.1.30 up to (but not including) 3.2.0. The flaw resides in the Remote.pull() method, whose "unsafe-option" guard inspects only keyword arguments and fails to validate the positional refspec argument. An attacker who controls the refspec can inject --upload-pack=<command> to execute arbitrary OS commands as the process that invokes GitPython, over local-path or SSH transports. Any application or automation pipeline that passes untrusted input into the positional refspec of Remote.pull() is at risk of full command execution with the privileges of the calling process.

Technical Analysis

GitPython is a Python library that wraps the native Git command-line binary. Many of its public methods translate Python arguments into Git CLI arguments and invoke a subprocess. Because Git itself accepts dangerous option strings (for example --upload-pack, which specifies the remote end's program used to locate and serve the repository), GitPython maintains a guard that rejects these "unsafe options" when exposed through user-supplied input.

The CVE description states the core defect precisely: the unsafe-option guard in Remote.pull() "inspects only keyword arguments, not the positional refspec." A refspec is the positional argument to git pull that describes which remote references map to which local references (e.g. origin main). Because this guard is applied only to keyword-style arguments, an attacker who can influence the positional refspec can smuggle Git options directly onto the command line. The specific option named in the description is --upload-pack=<command>, which instructs the transport (local-path or SSH) to run <command> on the remote side of the git-upload-pack negotiation. When the command is attacker-controlled, this yields OS command execution as the calling process.

The vulnerability class is CWE-88, Improper Neutralization of Argument Delimiters in a Command ("Argument Injection"). The conceptual breakdown is:

• Attack surface: any application, service, CI/CD job, or library consumer that lets an external or less-trusted party supply the refspec string passed positionally into Remote.pull().
• Trigger condition: the supplied string begins with an option such as --upload-pack=... rather than a legitimate refspec, causing Git to interpret it as a command-line option instead of a ref.
• Guard bypass: the mitigation logic ("unsafe-option guard") is applied to keyword arguments only, so the positional path is unprotected. This is a classic option-versus-value parsing gap: the code validates one parameter-passing style and ignores the other.
• Transport dependency: the description explicitly limits impact to local-path and SSH transports, the two transports for which --upload-pack spawns a process to serve the remote repository. The attack does not require the target to be internet-facing if the attacker already controls the refspec value through an application-layer input.

No function names beyond Remote.pull(), no URL endpoints, and no internal code symbols are asserted here, because none are provided. The NVD description does not specify a CWE mapping to anything other than argument injection, and no proof-of-concept or exploit code is known to exist publicly.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-88 argument injection) and the description supplied.

1. Reconnaissance / target identification. The attacker identifies an application, service, or automation job that accepts a refspec (or a value used to build a refspec) from an external source and passes it positionally to GitPython's Remote.pull(). Realistic surfaces include web-based Git management front ends, internal tooling that pulls branches specified by user request, pull/refresh buttons that accept a branch parameter, CI/CD pipelines triggered by contributed metadata, and any integration that mirrors or synchronizes repositories based on a caller-provided reference. The attacker does not necessarily need network access to Git itself — control of the input that becomes the refspec is sufficient.

2. Triggering the flaw. The attacker supplies a value designed to be parsed by Git as an option rather than a ref. The description names the mechanism: instead of a normal refspec, the input is crafted to begin with --upload-pack=<command>. Because the guard inspects only keyword arguments, the positional argument is passed through uninspected to the underlying git pull invocation.

3. Payload / execution. When GitPython invokes git pull with the attacker-controlled positional argument, Git processes --upload-pack=<command> as a transport option. Over a local-path or SSH transport, Git executes the string supplied as <command> to run the remote upload-pack service. The command therefore executes with the privileges of the process calling GitPython. The <command> content is at the attacker's discretion (subject to command-line length and quoting constraints of the surrounding call), making this an arbitrary-command capability rather than a fixed payload.

4. Post-exploitation impact. Successful execution grants the attacker the permissions of the calling process — commonly an application service account, CI runner identity, or automation principal. From there, typical objectives include reading repository contents, exfiltrating credentials and tokens present in the execution environment, writing to the host, lateral movement within the environment, and persistence. Because the library is often used inside build and deployment tooling, compromise can propagate into artifacts and downstream systems.

Impact Assessment

The CVSS v3.1 base score is 8.1 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Interpretation of the subscores:

• AV:N (Network) — the vulnerable component can be reached over a network in deployment scenarios, reflecting use in services and remote integrations, though exploitation depends on the attacker's ability to control the refspec input.
• AC:H (High attack complexity) — exploitation is not a simple unauthenticated click; it requires the attacker to influence a specific positional argument and depends on the transport being local-path or SSH. This is consistent with argument injection that requires an application-level input path.
• PR:N (No privileges required) — no prior authentication to GitPython itself is required if the input channel is open.
• UI:N (No user interaction) — no victim action is needed once the malicious refspec is supplied.
• S:U (Unchanged scope) — impact is confined to the security authority of the vulnerable component's process.
• C:H / I:H / A:H — high confidentiality, integrity, and availability impact, consistent with arbitrary OS command execution: full read of accessible data, arbitrary modification, and the ability to disrupt the host or process.

Blast radius: any Python application, service, or automation that (a) runs GitPython in the affected version range and (b) allows an external or less-trusted party to influence the positional refspec of Remote.pull(). Because GitPython is widely embedded in build, deployment, and repository-management tooling, a single exposed integration can yield code execution across a build fleet if the runner identity is broadly privileged. Applications that only ever pass hard-coded or fully trusted refspecs are not exposed through this vector. EPSS has not yet been scored by FIRST.org; no value should be assumed. CVE-2026-110858 is not listed in CISA KEV, and no exploit-in-the-wild evidence is provided.

Detection Guidance

Sigma Rule

title: Potential GitPython Remote.pull() Argument Injection (CVE-2026-110858)
id: 3f6a1c2e-9d44-4b7e-8a10-cve2026110858
status: experimental
description: Detects process execution consistent with --upload-pack option injection via GitPython Remote.pull() refspec argument.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110858
author: valtersit.com
logsource:
  category: process_creation
  product: linux
detection:
  selection_git:
    Image|endswith: '/git'
  selection_cmdline:
    CommandLine|contains:
      - 'pull'
      - '--upload-pack'
  condition: selection_git and selection_cmdline
fields:
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate use of --upload-pack in controlled repository mirroring
  - Administrative troubleshooting on trusted repositories only
level: high
tags:
  - attack.t1190
  - cve.2026.110858

YARA Rule

rule CVE_2026_110858_GitPython_UploadPack_Injection
{
    meta:
        description = "Detects strings indicating GitPython Remote.pull() positional refspec option injection via --upload-pack"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110858"
        date = "2026-01-01"
        severity = "high"
    strings:
        $gp = "Remote.pull" ascii wide nocase
        $upload = "--upload-pack" ascii wide nocase
        $opt = "--upload-pack=" ascii wide
        $py = ".py" ascii wide
    condition:
        (uint32(0) == 0x0A0D3B23 or true) and
        ($upload or $opt) and
        (any of ($py) or $gp)
}

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"CVE-2026-110858 GitPython Remote.pull --upload-pack argument injection attempt over SSH"; flow:to_server,established; content:"--upload-pack="; nocase; threshold:type limit, track by_src, count 3, seconds 60; reference:cve,2026-110858; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110858; classtype:attempted-admin; sid:2026110858; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("git", "git.exe") and
  process.command_line : "*pull*" and
  process.command_line : "*--upload-pack*"

Splunk SPL Query

index=endpoint sourcetype=process_execution (process_name=git OR process_name=git.exe)
| search command_line="*pull*" command_line="*--upload-pack*"
| stats count min(_time) as first_seen max(_time) as last_seen by host user process_name command_line
| sort -last_seen

Wazuh OSSEC Rule

<group name="gitpython,cve-2026-110858,">
  <rule id="2026110858" level="12">
    <if_sid>5710</if_sid>
    <field name="command">pull</field>
    <field name="command">--upload-pack</field>
    <match>--upload-pack=</match>
    <description>CVE-2026-110858: Git pull invoked with --upload-pack option (potential GitPython Remote.pull argument injection)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_110858,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, commit, or release artifact has been verified. The affected range is stated as from 3.1.30 up to but not including 3.2.0, but no confirmed fixed release is available to recommend.

1. Immediate mitigations

• Validate and sanitize any value that can become the positional refspec of Remote.pull(). Reject strings that begin with - or contain --upload-pack, --receive-pack, or other option delimiters, since a legitimate refspec should never start with a dash.
• Where possible, refactor calls to pass the refspec through a validated allowlist of known branch/tag names rather than accepting free-form input.
• Restrict who can influence refspec input. Treat branch/tag parameters from external callers as untrusted.
• Limit the privileges of the process that runs GitPython so that any injected command executes as a low-privilege, contained identity (dedicated service account, restricted CI runner, sandbox/container).
• Constrain the transports in use. The described impact applies to local-path and SSH transports; avoid allowing attacker-influenced refspecs in those contexts wherever feasible.
• Monitor child processes spawned from GitPython-driven git pull invocations for --upload-pack and for unexpected command execution.

2. Patch/upgrade steps

• No patch is available from any tracked source. Do not assume a fixed version exists. Monitor the GitPython project and authoritative vulnerability feeds (NVD, OSV, vendor advisories) for a confirmed advisory and fixed release.
• If and when a fix is published, upgrade to the earliest patched release beyond the affected range and re-validate all refspec input paths. Apply input validation first regardless of upgrade status, since validation is defense in depth if the library fix is incomplete.
• Inventory all GitPython deployments and enumerate every call site that passes an externally influenced argument to Remote.pull().

3. Long-term hardening

• Adopt strict argument-parsing discipline library-wide: treat both keyword and positional argument channels as untrusted and apply validation uniformly. This CVE is the direct consequence of validating one channel and not the other.
• Prefer passing refspecs and options via safe, structured APIs (arg lists without shell interpretation) and avoid constructing option-like values from user input.
• Enforce least privilege and network egress restrictions on any component that shells out to Git, so successful injection cannot trivially pivot.
• Add CI/CD policy checks that fail builds which feed untrusted refspecs into GitPython, and maintain dependency scanning against CVE-2026-110858 with alerting on affected versions.

References

• NVD — CVE-2026-110858: https://nvd.nist.gov/vuln/detail/CVE-2026-110858
• CWE-88, Improper Neutralization of Argument Delimiters in a Command: https://cwe.mitre.org/data/definitions/88.html
• MITRE ATT&CK T1190, Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• GitPython project repository (monitor for advisory/fixed release): https://github.com/gitpython-developers/GitPython
• OSV vulnerability database (for affected-package and fix tracking): https://osv.dev/

No threat actor campaigns or exploit-in-the-wild evidence are known. CVE-2026-110858 is not listed in CISA KEV. EPSS has not yet been scored by FIRST.org. PoC/exploit code and Nuclei templates are not available.