CVE-2026-110859: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in gitpython-developers GitPython
Description
GitPython versions before 3.2.0 contain an argument injection vulnerability in the Head.checkout() function. This flaw allows remote attackers to read arbitrary files by supplying a specially crafted branch name that is interpreted as a git option. Specifically, an attacker can create a repository with a default branch named --pathspec-from-file=<path>, causing applications that clone and check out the active branch to leak file contents via error messages.
CVSS v4.0
Score 8.7high
Affected software
gitpython-developers
GitPython
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-110859 is an argument injection vulnerability in GitPython prior to version 3.2.0. The vulnerability exists in the Head.checkout() method, where user-supplied branch names are not properly neutralized, allowing them to be parsed as git command options. An attacker can exploit this by hosting a repository with a default branch named --pathspec-from-file=<path>, which causes cloning applications that automatically check out the active branch to leak arbitrary file contents through GitCommandError messages.
Potential Impact
Exploitation of this vulnerability allows remote attackers to read arbitrary files on the system of the user cloning the malicious repository. This can lead to unauthorized disclosure of sensitive information. The CVSS 4.0 score is 8.7 (high severity), indicating a significant impact with no required privileges or user interaction.
Mitigation Recommendations
A fix is available in GitPython version 3.2.0 and later. Users and organizations should upgrade to version 3.2.0 or newer to remediate this vulnerability. Until upgraded, avoid cloning repositories from untrusted sources or that may contain malicious branch names.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-14T22:18:33.239Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad00a642cdf04f656ba02f9
Added to database: 10/14/2026, 23:04:04 UTC
Last enriched: 10/14/2026, 23:18:31 UTC
Last updated: 10/14/2026, 23:20:01 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.