Search: CVE-2026-42215

GitPython versions from 3.1.30 up to but not including 3.1.47 contain an OS command injection vulnerability. This occurs because certain Python keyword arguments (upload_pack and receive_pack) bypass the library's default blocking of dangerous Git options, allowing attacker-controlled input to lead to arbitrary command execution. The issue is fixed in version 3.1.47. The vulnerability has a high severity with a CVSS score of 8.