CVE-2026-42215

High

Advisory

Published 25 Apr 2026In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.8; base score, highest
EPSS: 0.007; 53rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 25; of 17,781 indexed, latest versions
Container images: 37; deployed by those charts
Fix available: 1 of 1; affected package

GitPython has Command Injection via Git options bypass

Carried by container images the latest versions of 25 of 17,781 indexed charts deploy, on 37 images.

Affected package	Affected versions	Fixed in	Images
gitpythonpypi	3.1.31, 3.1.37, 3.1.40, 3.1.41+5 more	3.1.47	37

OSV records: GHSA-rpm5-65cw-6hj4
Also known as: PYSEC-2026-2160

Charts affected

25 by stars

Chart

Latest

Affected images

Radar Score

stackstorm-hastackstorm

1.1.0

11 of 17 See more

stackstorm-ha stackstorm 1.1.0

11 of the 17 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
stackstorm/st2actionrunner :3.8	88235ba70cad	gitpython@3.1.37	3.1.47
stackstorm/st2api :3.8	6f56d239d280	gitpython@3.1.37	3.1.47
stackstorm/st2auth :3.8	33ecfda16608	gitpython@3.1.37	3.1.47
stackstorm/st2garbagecollector :3.8	4e3f8c7ca52d	gitpython@3.1.37	3.1.47
stackstorm/st2notifier :3.8	f190a6212195	gitpython@3.1.37	3.1.47
stackstorm/st2rulesengine :3.8	259503496ff9	gitpython@3.1.37	3.1.47
stackstorm/st2scheduler :3.8	b1de2055c362	gitpython@3.1.37	3.1.47
stackstorm/st2sensorcontainer :3.8	b1a338f64773	gitpython@3.1.37	3.1.47
stackstorm/st2stream :3.8	1c8904a3bf67	gitpython@3.1.37	3.1.47
stackstorm/st2timersengine :3.8	1bf35bfaf00c	gitpython@3.1.37	3.1.47
stackstorm/st2workflowengine :3.8	19fdfffdbba8	gitpython@3.1.37	3.1.47

Open the chart page →

96,419

nautobotnautobot

3.1.2

1 of 1 See more

nautobot nautobot 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
networktocode/nautobot :3.0-py3.13	ed484336b1ad	gitpython@3.1.46	3.1.47

Open the chart page →

4,332

daskhubdask

2024.1.1

1 of 9 See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
pangeo/base-notebook :2024.01.15	5fbe688a4f80	gitpython@3.1.41	3.1.47

Open the chart page →

14,094

mlflowgetindata

0.1.2

1 of 1 See more

mlflow getindata 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
gcr.io/getindata-images-public/mlflow :latest	25d6975951f1	gitpython@3.1.43	3.1.47

Open the chart page →

2,452

squestchristianhuth

6.6.7

1 of 4 See more

squest christianhuth 6.6.7

1 of the 4 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
quay.io/hewlettpackardenterprise/squest :2.8.4	65694109877e	gitpython@3.1.43	3.1.47

Open the chart page →

9,971

cosmotech-copilot-apicosmotech-api

0.1.1

1 of 1 See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api :latest	a2be95de450c	gitpython@3.1.42	3.1.47

Open the chart page →

11,205

helmuphelmup

0.1.0

2 of 3 See more

helmup helmup 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
sirrend/helmup-engine :0.1.13	699e79e3d4e2	gitpython@3.1.40	3.1.47
sirrend/helmup-github-scraper :0.1.4	7ca688c7abf5	gitpython@3.1.40	3.1.47

Open the chart page →

16,514

mlflow-controllermlflow-deployment-controller

0.1.8

2 of 2 See more

mlflow-controller mlflow-deployment-controller 0.1.8

2 of the 2 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
tachyongroup/mlflow-deployment-controller :mlflow-controller-0.1.8	7e79b9000856	gitpython@3.1.31	3.1.47
tachyongroup/mlflow-deployment-controller-ui :mlflow-controller-0.1.8	f4f7fabe1037	gitpython@3.1.31	3.1.47

Open the chart page →

8,957

ovh-snapshoterovh-snapshoter

0.4.10

1 of 1 See more

ovh-snapshoter ovh-snapshoter 0.4.10

1 of the 1 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
ghcr.io/hoverkraft-tech/ovh-snapshoter/app :0.4.10	10d271f08ab3	gitpython@3.1.42	3.1.47

Open the chart page →

761

streamlit-appstreamlit-app

0.2.0

1 of 1 See more

streamlit-app streamlit-app 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
sruthitanneru/pi-sample :ui-latest	e565ea454ffd	gitpython@3.1.43	3.1.47

Open the chart page →

1,696

ansible-inspecansible-inspec

0.2.17

1 of 2 See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	gitpython@3.1.46	3.1.47

Open the chart page →

5,558

opencvecfi2017

0.1.2

1 of 7 See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
ghcr.io/cfi2017/opencve-scheduler :3.0.0	8d943799621b	gitpython@3.1.44	3.1.47

Open the chart page →

15,371

csghubcsghub

2.4.3

1 of 34 See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
opencsghq/agenticflow :ee-v0.6-5	2f03fead54db	gitpython@3.1.43	3.1.47

Open the chart page →

58,897

csgshipcsghub

0.4.6

1 of 10 See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
opencsghq/csgship-web :v0.4.0	c36a5bac3cf0	gitpython@3.1.41	3.1.47

Open the chart page →

11,335

jupyterhubd4n

3.3.7

1 of 7 See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
aristidetm/basic-notebook :3.6.5	469dbc951224	gitpython@3.1.43	3.1.47

Open the chart page →

16,604

skypilotgeek-cookbook

0.0.1

1 of 3 See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
berkeleyskypilot/skypilot-nightly :latest	8da2f3cda472	gitpython@3.1.45	3.1.47

Open the chart page →

8,923

fastmcp-serverhelmforge

1.7.4

1 of 1 See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
helmforge/fastmcp-server :0.11.2	fcb7017327d6	gitpython@3.1.44	3.1.47

Open the chart page →

3,281

mcp-serverhelmforge

1.0.0

1 of 1 See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
helmforge/fastmcp-server :0.2.0	61f759a1421f	gitpython@3.1.44	3.1.47

Open the chart page →

3,430

ilum-streamlitilum

0.1.0

1 of 1 See more

ilum-streamlit ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
ilum/streamlit-example :1.0.0	ce5dcdeb22ba	gitpython@3.1.45	3.1.47

Open the chart page →

2,736

intelowlintelowl-helm

6.6.1-01-06-2026

1 of 5 See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
intelowlproject/intelowl :v6.6.1	0b22e547ea6b	gitpython@3.1.41	3.1.47

Open the chart page →

17,852

aperagkubeblocks

0.0.0-nightly

1 of 3 See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	gitpython@3.1.44	3.1.47

Open the chart page →

8,405

mlflow-servermlflow-server

0.3.0

1 of 1 See more

mlflow-server mlflow-server 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
ghcr.io/mlops-for-all/mlflow-tracking-server :3.8-1.30.1-v1.0.0	d30e631684c3	gitpython@3.1.31	3.1.47

Open the chart page →

3,158

mlflowmondata-helm-charts

0.2.3

1 of 1 See more

mlflow mondata-helm-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
mondata/mlflow :v2.3.0.s3.gc	6f94c6caf8bf	gitpython@3.1.31	3.1.47

Open the chart page →

3,811

mlflowncsa

1.2.1

1 of 4 See more

5,456

chatbot-ai-sampleopenshift

0.1.6

1 of 4 See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-42215.

Container image	Digest	Package	Fixed in
quay.io/redhat-ai-dev/chatbot :latest	59fe607dfdf2	gitpython@3.1.43	3.1.47

Open the chart page →

18,922

Container images carrying it

37 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	gitpython@3.1.44	3.1.47	1
aristidetm/basic-notebook :3.6.5	469dbc951224	gitpython@3.1.43	3.1.47	1
berkeleyskypilot/skypilot-nightly :latest	8da2f3cda472	gitpython@3.1.45	3.1.47	1
evk02/mlflow :2.2.1	ef6ff257ef35	gitpython@3.1.31	3.1.47	1
helmforge/fastmcp-server :0.2.0	61f759a1421f	gitpython@3.1.44	3.1.47	1
helmforge/fastmcp-server :0.11.2	fcb7017327d6	gitpython@3.1.44	3.1.47	1
ilum/streamlit-example :1.0.0	ce5dcdeb22ba	gitpython@3.1.45	3.1.47	1
intelowlproject/intelowl :v6.6.1	0b22e547ea6b	gitpython@3.1.41	3.1.47	1
mondata/mlflow :v2.3.0.s3.gc	6f94c6caf8bf	gitpython@3.1.31	3.1.47	1
networktocode/nautobot :3.0-py3.13	ed484336b1ad	gitpython@3.1.46	3.1.47	1
opencsghq/agenticflow :ee-v0.6-5	2f03fead54db	gitpython@3.1.43	3.1.47	1
opencsghq/csgship-web :v0.4.0	c36a5bac3cf0	gitpython@3.1.41	3.1.47	1
pangeo/base-notebook :2024.01.15	5fbe688a4f80	gitpython@3.1.41	3.1.47	1
sirrend/helmup-engine :0.1.13	699e79e3d4e2	gitpython@3.1.40	3.1.47	1
sirrend/helmup-github-scraper :0.1.4	7ca688c7abf5	gitpython@3.1.40	3.1.47	1
sruthitanneru/pi-sample :ui-latest	e565ea454ffd	gitpython@3.1.43	3.1.47	1
stackstorm/st2actionrunner :3.8	88235ba70cad	gitpython@3.1.37	3.1.47	1
stackstorm/st2api :3.8	6f56d239d280	gitpython@3.1.37	3.1.47	1
stackstorm/st2auth :3.8	33ecfda16608	gitpython@3.1.37	3.1.47	1
stackstorm/st2garbagecollector :3.8	4e3f8c7ca52d	gitpython@3.1.37	3.1.47	1
stackstorm/st2notifier :3.8	f190a6212195	gitpython@3.1.37	3.1.47	1
stackstorm/st2rulesengine :3.8	259503496ff9	gitpython@3.1.37	3.1.47	1
stackstorm/st2scheduler :3.8	b1de2055c362	gitpython@3.1.37	3.1.47	1
stackstorm/st2sensorcontainer :3.8	b1a338f64773	gitpython@3.1.37	3.1.47	1
stackstorm/st2stream :3.8	1c8904a3bf67	gitpython@3.1.37	3.1.47	1
stackstorm/st2timersengine :3.8	1bf35bfaf00c	gitpython@3.1.37	3.1.47	1
stackstorm/st2workflowengine :3.8	19fdfffdbba8	gitpython@3.1.37	3.1.47	1
tachyongroup/mlflow-deployment-controller :mlflow-controller-0.1.8	7e79b9000856	gitpython@3.1.31	3.1.47	1
tachyongroup/mlflow-deployment-controller-ui :mlflow-controller-0.1.8	f4f7fabe1037	gitpython@3.1.31	3.1.47	1
gcr.io/getindata-images-public/mlflow :latest	25d6975951f1	gitpython@3.1.43	3.1.47	1
ghcr.io/cfi2017/opencve-scheduler :3.0.0	8d943799621b	gitpython@3.1.44	3.1.47	1
ghcr.io/cosmo-tech/cosmotech-copilot-api :latest	a2be95de450c	gitpython@3.1.42	3.1.47	1
ghcr.io/hoverkraft-tech/ovh-snapshoter/app :0.4.10	10d271f08ab3	gitpython@3.1.42	3.1.47	1
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	gitpython@3.1.46	3.1.47	1
ghcr.io/mlops-for-all/mlflow-tracking-server :3.8-1.30.1-v1.0.0	d30e631684c3	gitpython@3.1.31	3.1.47	1
quay.io/hewlettpackardenterprise/squest :2.8.4	65694109877e	gitpython@3.1.43	3.1.47	1
quay.io/redhat-ai-dev/chatbot :latest	59fe607dfdf2	gitpython@3.1.43	3.1.47	1