GitPython Argument Injection Flaw Lets Attackers Read Files via Branch Names

A high-severity argument injection vulnerability exists in the GitPython library, exposing applications that use the package for repository management. The flaw allows remote attackers to read arbitrary files on a system by supplying a specially crafted branch name that is parsed as a git command option.

What happened

The National Vulnerability Database records CVE-2026-110859 as a high-severity issue affecting GitPython before version 3.2.0. According to the NVD record, the weakness stems from argument injection in the Head.checkout() function. This flaw is categorized under CWE-88, which refers to improper neutralization of special elements used in an OS command.

An attacker can exploit this by hosting a repository where the default branch is named with a specific string. That string is --pathspec-from-file followed by a file path. When an application using GitPython clones this repository and checks out the active branch, the library processes the branch name as a git option. This action causes the system to leak the contents of the specified file through GitCommandError messages.

The NVD description notes that this mechanism allows remote attackers to read arbitrary files. The vulnerability relies on the standard cloning process where applications check out the active branch. Any application that automatically checks out the default branch of a fetched repository is potentially exposed to this file disclosure attack.

Why it matters

Security operations teams must recognize that library dependencies often contain hidden command injection risks. GitPython is a widely used Python interface for Git, meaning many automation scripts and CI/CD pipelines may rely on it. The high CVSS score of 8.7 indicates a severe risk profile for any system running vulnerable versions.

The nature of this flaw makes it particularly insidious because it hides within normal repository metadata. Branch names are typically trusted inputs, but here they serve as a vector for command manipulation. Teams that have not audited their Python dependencies for recent updates may be running exposed versions. The ability to read arbitrary files can lead to further compromise, including access to credentials or sensitive configuration data stored on the host.

Our take on the response

• Review all Python environments for the presence of GitPython versions earlier than 3.2.0.
• Isolate systems that interact with untrusted repositories to limit potential file disclosure.
• Monitor error logs for GitCommandError messages that appear during routine clone operations.
• Verify that all automated build processes use trusted and patched library versions.

What defenders should look for

Teams usually detect this activity by reviewing application logs for unexpected GitCommandError messages during repository checkout. Check whether any error outputs contain file paths or data that should not be visible during normal operations. Look for anomalies in branch names that resemble command-line arguments or options. Monitor for access to sensitive files coinciding with repository sync events. Isolate affected workloads if suspicious patterns emerge to prevent further data leakage.

Background: CI/CD pipeline vulnerabilities

Monitor for broken dependency chains, unexpected secret usage, and altered build artifacts. Check pipeline logs for unauthorized job triggers. Validate every input against a strict schema. Isolate build agents from production networks. Rotate credentials immediately upon any anomaly detection.

Read the full guide: Warning Signs of CI/CD Pipeline Vulnerabilities

What to do and how to stay safe: GitPython

• Audit your Python dependency tree to identify any instances of GitPython older than version 3.2.0.
• Restrict the ability of automated tools to execute git commands on untrusted repositories.
• Monitor system logs for GitCommandError exceptions that may indicate attempted file disclosure.
• Once the vendor provides an update, apply the patch to all affected environments immediately.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for the GitPython vulnerability?

The vulnerability has a CVSS score of 8.7, which is classified as high severity.

Which versions of GitPython are affected by this flaw?

All versions of GitPython released before version 3.2.0 are affected by this argument injection vulnerability.

How does the attacker exploit the vulnerability?

The attacker hosts a repository with a default branch named --pathspec-from-file=<path>, causing file contents to leak during checkout.