Description
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gitpython-developers | GitPython | 3.1.30 – < 3.2.0 | 3.2.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-git | 3.2.1-1 | — |
| Debian 13 | python-git | 3.1.44-1+deb13u1 | — |
| Debian 12 | python-git | 3.1.30-1+deb12u3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-git | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | python-git | No fix yet | — |
| Ubuntu Pro 24.04 LTS | python-git | No fix yet | — |
| Ubuntu Pro 22.04 LTS | python-git | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-git | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python-git | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python-git | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python-git | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | openvox-agent | 8.31.1-1.el9sat | RHSA-2026:95657, RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite Capsule 6 | openvox-server | 8.17.0-1.el9sat | RHSA-2026:95657, RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite Capsule 6 | python-brotli +1 | 1.2.1-1.el8pc | RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite Capsule 6 | python-django +1 | 4.2.30-2.el8pc | RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite Capsule 6 | python-gitpython +1 | 3.2.1-1.el8pc | RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite Capsule 6 | python-pillow +1 | 13.0.0-1.el8pc | RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite Capsule 6 | python-pyyaml +1 | 6.0.1-1.el8pc | RHSA-2026:95655 |
| Red Hat Satellite Capsule 6 | python-urllib3 +1 | 2.8.0-1.el8pc | RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite Capsule 6 | python3.12-brotli | 1.2.1-1.el9pc | RHSA-2026:95657, RHSA-2026:92861 |
| Red Hat Satellite Capsule 6 | python3.12-django | 4.2.30-3.el9pc | RHSA-2026:95657, RHSA-2026:92861 |
| Red Hat Satellite Capsule 6 | python3.12-gitpython | 3.2.1-1.el9pc | RHSA-2026:95657, RHSA-2026:92861 |
| Red Hat Satellite Capsule 6 | python3.12-pillow | 13.0.0-1.el9pc | RHSA-2026:95657, RHSA-2026:92861 |
| Red Hat Satellite Capsule 6 | python3.12-pulp-ansible | 1:0.28.10-1.el9pc | RHSA-2026:92861 |
| Red Hat Satellite Capsule 6 | python3.12-urllib3 | 2.8.0-1.el9pc | RHSA-2026:95657, RHSA-2026:92861 |
| Red Hat Satellite 6 | openvox-agent | 8.31.1-1.el9sat | RHSA-2026:95657, RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite 6 | openvox-server | 8.17.0-1.el9sat | RHSA-2026:95657, RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite 6 | python-brotli +1 | 1.2.1-1.el8pc | RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite 6 | python-django +1 | 4.2.30-2.el8pc | RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite 6 | python-gitpython +1 | 3.2.1-1.el8pc | RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite 6 | python-pillow +1 | 13.0.0-1.el8pc | RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite 6 | python-pyyaml +1 | 6.0.1-1.el8pc | RHSA-2026:95655 |
| Red Hat Satellite 6 | python-urllib3 +1 | 2.8.0-1.el8pc | RHSA-2026:95656, RHSA-2026:95655 |
| Red Hat Satellite 6 | python3.12-brotli | 1.2.1-1.el9pc | RHSA-2026:95657, RHSA-2026:92861 |
| Red Hat Satellite 6 | python3.12-django | 4.2.30-3.el9pc | RHSA-2026:95657, RHSA-2026:92861 |
| Red Hat Satellite 6 | python3.12-gitpython | 3.2.1-1.el9pc | RHSA-2026:95657, RHSA-2026:92861 |
| Red Hat Satellite 6 | python3.12-pillow | 13.0.0-1.el9pc | RHSA-2026:95657, RHSA-2026:92861 |
| Red Hat Satellite 6 | python3.12-pulp-ansible | 1:0.28.10-1.el9pc | RHSA-2026:92861 |
| Red Hat Satellite 6 | python3.12-urllib3 | 2.8.0-1.el9pc | RHSA-2026:95657, RHSA-2026:92861 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.1.1-1.el9sat | RHSA-2026:92861 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.5.38-1.el8ap | RHSA-2026:99008, RHSA-2026:99007, RHSA-2026:99006 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-GitPython | 3.2.1-1.1 | openSUSE-SU-2026:12391-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | gitpython | >= 3.1.30, < 3.2.0 | 3.2.0 | GHSA-f9j4-qggq-h239 |
Advisories 9
- RHSA-2026:95656 Red Hat Security Advisory: Satellite 6.17 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95655 Red Hat Security Advisory: Satellite 6.16 EUS security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95657 Red Hat Security Advisory: Satellite 6.18 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:92861 Red Hat Security Advisory: Satellite 6.19 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:99007 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:99008 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:99006 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-4532 Red Hat Ansible Automation Platform (GitPython): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- openSUSE-SU-2026:12391-1 python313-GitPython-3.2.1-1.1 on GA media SUSE / openSUSE Security Updates · Nov 3, 2026
References
- GitHub Security Advisory (GHSA-f9j4-qggq-h239) vendor-advisory
- VulnCheck Advisory: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec third-party-advisory