CVE-2026-42284: GitPython Vulnerability Allows Remote Code Execution Via Malicious Clones

The National Vulnerability Database has identified a critical vulnerability, CVE-2026-42284, in GitPython, a popular Python library for Git interaction. Versions prior to 3.1.47 are susceptible to an attack where a specially crafted clone URL can trick the library into executing arbitrary code. Attackers can exploit this by providing malicious options within a clone command, which, after being parsed, instructs Git to use a compromised hooks path. This allows for code execution during the cloning process, bypassing standard security checks.

The CVSS score of 8.1 (HIGH) underscores the severity of this flaw. The vulnerability, categorized under CWE-88 (Argument Injection), affects any system using a vulnerable version of GitPython to clone repositories. The National Vulnerability Database notes that the affected products were not explicitly specified, but the widespread use of GitPython in development workflows means a broad range of applications and automated systems could be at risk if they perform remote Git operations without proper input sanitization or updated libraries.

Defenders must prioritize updating GitPython to version 3.1.47 or later. For organizations unable to update immediately, implementing stricter input validation on any parameters used in Git clone operations is crucial. Auditing systems for unexpected Git hook executions or unusual configurations related to core.hooksPath should also be considered to detect potential exploitation.