GHSA-9rj7-rf2p-w77r: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
(updated )
Repo.init() forwards **kwargs verbatim to git init with no unsafe-option guard and no allow_unsafe_options parameter. git init --template=<dir> copies <dir>/hooks/* into the new repo’s .git/hooks, so an attacker-controlled template kwarg plants a hook that executes on the next git operation → arbitrary code execution. --template is already recognized as unsafe for clone (it is on unsafe_git_clone_options, and GHSA-6p8h-3wgx-97gf covers the clone path), but Repo.init is a distinct method that never received a guard and needs an independent fix.
References
- github.com/advisories/GHSA-9rj7-rf2p-w77r
- github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66
- github.com/gitpython-developers/GitPython/pull/2204
- github.com/gitpython-developers/GitPython/releases/tag/3.1.58
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r
- nvd.nist.gov/vuln/detail/CVE-2026-76218
- www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init
Code Behaviors & Features
Detect and mitigate GHSA-9rj7-rf2p-w77r with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →