CVE-2026-42284

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options)). A string like "--branch main --config core.hooksPath=/x" passes validation (starts with --branch), but after split becomes ["--branch", "main", "--config", "core.hooksPath=/x"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.

• CWE-88

• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47Patch, Release Notes
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485Exploit, Vendor Advisory
• https://www.tenable.com/cve/CVE-2026-32686

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42279solidtime is an open-source time-tracking app. In version 0.…5.8
• CVE-2026-4228A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. Thi…9.8
• CVE-2026-42280Auth0.js is a client-side JavaScript library for Auth0. From…7.1
• CVE-2026-42281MagicMirror² is an open source modular smart mirror platform…8.6
• CVE-2026-42282n8n-MCP is an MCP server that provides AI assistants access …4.3
• CVE-2026-42283DevSpace is a client-only developer tool for cloud-native de…7.8
• CVE-2026-42285GoBGP is an open source Border Gateway Protocol (BGP) implem…7.5
• CVE-2026-42286Emlog is an open source website building system. Prior to ve…8.4
• CVE-2026-42287Emlog is an open source website building system. Prior to ve…10
• CVE-2026-42288ChurchCRM is an open-source church management system. Prior …10
• CVE-2026-42289ChurchCRM is an open-source church management system. Prior …8.8
• CVE-2026-4229A flaw has been found in vanna-ai vanna up to 2.0.2. This im…7.3