CVE-2026-110857: Improper Validation of Specified Type of Input in gitpython-developers GitPython

CVE-2026-110857 affects GitPython versions prior to 3.2.0. The flaw is an improper validation of specified input types, specifically in the Git.ls_remote function which forwards URLs without check_unsafe_protocols validation. This allows attackers to use ext:: remote-helper URLs to execute arbitrary commands when the git client permits the ext transport. Furthermore, the merge_base and IndexFile.move functions accept options without proper guarding, enabling option injection. The CVSS 4.0 score is 7.7, indicating a high severity vulnerability with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction and partial attack complexity.

Successful exploitation can lead to remote code execution on the affected system, allowing attackers to run arbitrary commands. This compromises the confidentiality, integrity, and availability of the system running vulnerable GitPython versions. The vulnerability requires user interaction and has a high attack complexity, reducing the likelihood of automated widespread exploitation. There are no known exploits in the wild at this time.

A fixed version 3.2.0 of GitPython addresses this vulnerability. Users should upgrade to version 3.2.0 or later to remediate this issue. No vendor advisory content was provided, so patch status is inferred from the versioning information. Patch status is confirmed by the presence of fixed version 3.2.0. Until upgrade, avoid using untrusted URLs with Git.ls_remote and disable ext transport if possible.