CVE-2026-42284
Description
A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the _clone() function. By crafting a malicious string in the multi_options parameter, an attacker could bypass validation. This allows for the injection of arbitrary Git configurations, such as core.hooksPath, leading to the execution of attacker-controlled hooks and ultimately, arbitrary code execution during a clone operation.
Statement
This Important vulnerability in GitPython allows for arbitrary code execution during Git clone operations within Red Hat products that utilize the library. The flaw stems from insufficient validation of user-supplied input to the _clone() function, enabling an attacker to inject malicious Git configurations, such as core.hooksPath, and execute arbitrary code. Exploitation requires an application to process untrusted input through GitPython's cloning functionalities.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | 9.8 | 8.1 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | Low | High |
| Privileges Required | None | None | None |
| User Interaction | Required | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | High | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Red Hat Product Security considers this a conditional GitPython library flaw. Exploitation requires an application to pass attacker-controlled input to multi_options through clone_from(), clone(), or Submodule.update(), followed by a clone operation. We therefore assign UI, as code execution requires the application to perform the relevant clone/submodule action rather than being triggered solely by submitting malicious input. We also agree with the CNA's AC rating, since reaching multi_options with untrusted input represents a non-default integration pattern.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Other
Technical Impact: Execute Unauthorized Code or Commands; Alter Execution Logic; Read Application Data; Modify Application Data
An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
