CVE-2026-110859

Executive Summary

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages. This vulnerability affects any application using GitPython to clone and check out repositories from untrusted sources, with a CVSS score of 7.5 (High), and no patch evidence is currently available.

Technical Analysis

The vulnerability resides in GitPython's Head.checkout() method, which is responsible for checking out a branch. GitPython passes branch names directly to the underlying git command-line tool without proper argument sanitization. An attacker can create a Git repository with a default branch named --pathspec-from-file=<path>, where <path> is a file path on the victim's system. When a victim application clones this repository and attempts to check out the default branch, GitPython invokes git checkout --pathspec-from-file=<path>. The git command interprets this as an option rather than a branch name, reading the specified file as a pathspec. Because the file content is treated as a list of paths, git attempts to check out files listed in that file, and if the file is not a valid pathspec list, git raises an error. The error message generated by GitCommandError includes the contents of the file, thus leaking sensitive information. This is an argument injection flaw (CWE-88) that leverages the trust placed in branch names by GitPython.

Exploitation Scenarios

1. Reconnaissance: The attacker identifies a target application that uses GitPython to clone and automatically check out repositories from user-supplied URLs. This is common in CI/CD pipelines, code review tools, or any service that imports Git repositories.
2. Repository Setup: The attacker creates a Git repository with a default branch named --pathspec-from-file=/etc/passwd (or any other sensitive file path). The branch name is set in the repository's HEAD reference.
3. Trigger: The victim application clones the repository and calls Head.checkout() on the default branch. GitPython passes the branch name to the git checkout command without sanitization. The git command interprets the branch name as the --pathspec-from-file option and reads the specified file.
4. Exfiltration: The git command fails because the file does not contain a valid pathspec list, and the error message includes the file's content. GitPython wraps this in a GitCommandError exception. If the application logs or returns this error to the attacker (e.g., via a web interface), the file contents are leaked.
5. Post-Exploitation: The attacker can read arbitrary files accessible to the application's process, such as configuration files, SSH keys, or source code, leading to further compromise.

Impact Assessment

Successful exploitation allows remote attackers to read arbitrary files on the victim's system, leading to confidentiality breach. The CVSS score is 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network exploitable, low complexity, no privileges required, no user interaction, and high confidentiality impact. The blast radius includes any application using GitPython before 3.2.0 that processes untrusted repositories. This can affect CI/CD systems, code hosting platforms, and automated deployment tools, potentially exposing sensitive data like credentials, API keys, and proprietary source code.

Detection Guidance

Sigma Rule

title: GitPython Argument Injection via Malicious Branch Name
id: 5f8e9a2b-1c3d-4e5f-8a7b-9c0d1e2f3a4b
status: experimental
description: Detects attempts to exploit CVE-2026-110859 by monitoring for git checkout commands with suspicious pathspec-from-file arguments.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/git'
    CommandLine|contains: '--pathspec-from-file='
  condition: selection
falsepositives:
  - Legitimate use of --pathspec-from-file in automated scripts
level: high

YARA Rule

rule CVE_2026_110859_GitPython_Branch_Injection
{
    meta:
        description = "Detects Git repositories with branch names containing --pathspec-from-file"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "CVE-2026-110859"
        severity = "high"
    strings:
        $branch_name = "--pathspec-from-file="
    condition:
        $branch_name
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-110859 GitPython Argument Injection Attempt"; flow:to_server,established; content:"--pathspec-from-file="; fast_pattern; classtype:attempted-recon; sid:1000001; rev:1;)

Elastic Detection

process where process.name == "git" and process.args : "--pathspec-from-file=*"

Splunk SPL Query

index=main sourcetype=process_creation
| search process_name=git command_line="*--pathspec-from-file=*"
| table _time, host, user, process_name, command_line

Wazuh OSSEC Rule

<rule id="100001" level="12">
  <if_sid>5925</if_sid>
  <field name="command">--pathspec-from-file=</field>
  <description>CVE-2026-110859: GitPython argument injection attempt detected</description>
  <mitre>
    <id>T1195</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations: Avoid using GitPython to clone/checkout untrusted repositories. If unavoidable, sanitize branch names by rejecting any that start with - and validate against a whitelist. Alternatively, implement a wrapper that validates the branch name before passing to GitPython.
2. Patch/Upgrade Steps: Monitor the GitPython project for a security release. Once a patched version (3.2.0 or later) is available, upgrade immediately using pip install --upgrade gitpython. Verify the version with pip show gitpython.
3. Long-term Hardening: Apply the principle of least privilege to applications that use GitPython, ensuring they run with minimal file system permissions. Implement strict input validation for repository URLs and branch names. Consider using a sandboxed environment for cloning untrusted repositories. Regularly audit dependencies for known vulnerabilities.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110859
• GitPython GitHub: https://github.com/gitpython-developers/GitPython
• CWE-88: https://cwe.mitre.org/data/definitions/88.html
• CVSS Calculator: https://www.first.org/cvss/calculator/3.1
• CISA KEV: Not applicable (NO)