GHSA-9rj7-rf2p-w77r: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
(updated )
Repo.init() forwards **kwargs verbatim to git init with no unsafe-option guard and no allow_unsafe_options parameter. git init --template=<dir> copies <dir>/hooks/* into the new repo’s .git/hooks, so an attacker-controlled template kwarg plants a hook that executes on the next git operation → arbitrary code execution. --template is already recognized as unsafe for clone (it is on unsafe_git_clone_options, and GHSA-6p8h-3wgx-97gf covers the clone path), but Repo.init is a distinct method that never received a guard and needs an independent fix.
References
- github.com/advisories/GHSA-9rj7-rf2p-w77r
- github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66
- github.com/gitpython-developers/GitPython/pull/2204
- github.com/gitpython-developers/GitPython/releases/tag/3.1.58
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r
- nvd.nist.gov/vuln/detail/CVE-2026-76218
- www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init
Code Behaviors & Features
Detect and mitigate GHSA-9rj7-rf2p-w77r with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →