CVE-2026-78677: GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
- CWE: CWE-73 (External Control of File Name or Path) / CWE-22 (Path Traversal, in the “escapes intended base directory” sense)
- Affected component:
git/repo/base.py,Repo.unsafe_git_clone_options(class attribute, lines 153-165) andRepo._clone()(lines 1477-1520), reached via the publicRepo.clone_from()(line 1626) andRepo.clone()(line 1567) APIs. - Affected version: GitPython at HEAD (
9729ed3b948f2bde09f1f188c5311e172212b67e, 2026-08-05, VERSION3.1.58)
References
- github.com/advisories/GHSA-8mcc-hrx5-hvxc
- github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d
- github.com/gitpython-developers/GitPython/pull/2210
- github.com/gitpython-developers/GitPython/releases/tag/3.1.59
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc
- github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3787.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-78677
- www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir
Code Behaviors & Features
Detect and mitigate CVE-2026-78677 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →