{"metadata": {"vulnerability": "CVE-2026-110858", "count": 18, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110858", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T22:16:22.735Z", "date_only": false, "value": "2026-10-14T22:16:22.735Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110858", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T22:52:42.217Z", "date_only": false, "value": "2026-10-14T22:52:42.217Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110858", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T22:52:42.217Z", "date_only": false, "value": "2026-10-14T22:52:42.217Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110858", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T23:17:27Z", "date_only": false, "value": "2026-10-14T23:17:27Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MCF4-6385-6RCQ", "record": "GHSA-MCF4-6385-6RCQ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T23:17:27.043Z", "date_only": false, "value": "2026-10-14T23:17:27.043", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110858", "record": "FKIE_CVE-2026-110858", "field": "published"}, {"timestamp": "2026-10-14T23:40:04.759Z", "date_only": false, "value": "2026-10-14T23:40:04.759087Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxuptob5cm2h", "record": "CVE-2026-110858", "field": "creation_timestamp", "uuid": "39871ede-350d-4a37-997a-7861e228e610", "content": "CVE-2026-110858 - gitpython\nVersions 3.1.30 through 3.1.31 of GitPython do not properly check the arguments passed to the pull function, so a specially crafted reference can cause the program\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gitpython #gitpythondevelopers #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxuptob5cm2h"}, {"timestamp": "2026-10-15T00:08:44.578Z", "date_only": false, "value": "2026-10-15T00:08:44.578921Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxurgx2alq2w", "record": "CVE-2026-110858", "field": "creation_timestamp", "uuid": "dcaf312c-28a4-48a5-a1c1-d047e212ab7b", "content": "\ud83d\udea8 CVE-2026-110858 \u2014 CVSS 9.2 CRITICAL\n\nGitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose un...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110858\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxurgx2alq2w"}, {"timestamp": "2026-10-15T00:31:18Z", "date_only": false, "value": "2026-10-15T00:31:18Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MCF4-6385-6RCQ", "record": "GHSA-MCF4-6385-6RCQ", "field": "published"}, {"timestamp": "2026-10-15T00:31:18Z", "date_only": false, "value": "2026-10-15T00:31:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MCF4-6385-6RCQ", "record": "GHSA-MCF4-6385-6RCQ", "field": "modified"}, {"timestamp": "2026-10-15T01:15:27.809Z", "date_only": false, "value": "2026-10-15T01:15:27.809033Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117442276707033984", "record": "CVE-2026-110858", "field": "creation_timestamp", "uuid": "9475c85b-ef88-42ad-96a1-9dbe08904595", "content": "CVE-2026-110858 GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110858https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239https://www.vulncheck.com/advisories/gitpython-3.1.30-before-3.2.0-command-injection-via-remote-pull-refspec#gitpython-developers #GitPython#CVE_2026_110858#bot", "url": "https://infosec.exchange/users/cve/statuses/117442276707033984"}, {"timestamp": "2026-10-15T01:30:30.266Z", "date_only": false, "value": "2026-10-15T01:30:30.266063Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxuvz4ngax2p", "record": "cve-2026-110858", "field": "creation_timestamp", "uuid": "1853c4b0-3fc7-4ffb-8bdf-bc30c889f8b7", "content": "Critical RCE in GitPython 3.1.30 \u2013 3.2.0: CVE-2026-110858 lets attackers run OS commands via Remote.pull(). Restrict untrusted input & monitor for fixes. https://radar.offseq.com/threat/cve-2026-110858-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-in-eb08373a6f0fb...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mxuvz4ngax2p"}, {"timestamp": "2026-10-15T01:30:33.105Z", "date_only": false, "value": "2026-10-15T01:30:33.105910Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117442335694780632", "record": "cve-2026-110858", "field": "creation_timestamp", "uuid": "234de12d-96fe-413a-a88b-755b94129bf7", "content": "CVE-2026-110858 | GitPython 3.1.30 \u2013 3.2.0: CRITICAL RCE via improper argument neutralization in Remote.pull(). Attackers can run arbitrary OS commands over SSH/local. Limit use & watch for patches. https://radar.offseq.com/threat/cve-2026-110858-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-in-eb08373a6f0fb8af #OffSeq #GitPython #RCE #infosec", "url": "https://infosec.exchange/users/offseq/statuses/117442335694780632"}, {"timestamp": "2026-10-16T16:35:47.134Z", "date_only": false, "value": "2026-10-16T16:35:47.134823Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110858", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T16:35:47.134Z", "date_only": false, "value": "2026-10-16T16:35:47.134823Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110858", "record": "FKIE_CVE-2026-110858", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T17:14:41.140Z", "date_only": false, "value": "2026-10-16T17:14:41.140Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110858", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T17:14:41.140Z", "date_only": false, "value": "2026-10-16T17:14:41.140Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110858", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:17:34.013Z", "date_only": false, "value": "2026-10-16T18:17:34.013", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110858", "record": "FKIE_CVE-2026-110858", "field": "lastModified"}]}