CVE-2026-42284CRITICAL 9.8EPSS p42.7%

CVE-2026-42284CVE-2026-42284

Description

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options)). A string like "--branch main --config core.hooksPath=/x" passes validation (starts with --branch), but after split becomes ["--branch", "main", "--config", "core.hooksPath=/x"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.57% probability of exploitation · percentile 42.7% · 2026-06-19T12:03:05Z
Published2026-05-07
Last modified2026-05-08

Underlying weaknesses· 1

CWE-88

References

  1. https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47
  2. https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485
  3. https://www.tenable.com/cve/CVE-2026-32686

1

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Argument Delimiters in a Command ('Argument Injection')cwe-880%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-42215
CVE
CVE-2026-28291
CVE
CVE-2025-27614
CVE
CVE-2026-28292
CVE
CVE-2026-45571
CVE
CVE-2026-26268
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.