Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. GitPython
  4. ›
  5. GHSA-9rj7-rf2p-w77r

GHSA-9rj7-rf2p-w77r: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

August 7, 2026

Repo.init() forwards **kwargs verbatim to git init with no unsafe-option guard and no allow_unsafe_options parameter. git init --template=<dir> copies <dir>/hooks/* into the new repo’s .git/hooks, so an attacker-controlled template kwarg plants a hook that executes on the next git operation → arbitrary code execution. --template is already recognized as unsafe for clone (it is on unsafe_git_clone_options, and GHSA-6p8h-3wgx-97gf covers the clone path), but Repo.init is a distinct method that never received a guard and needs an independent fix.

References

  • github.com/advisories/GHSA-9rj7-rf2p-w77r
  • github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66
  • github.com/gitpython-developers/GitPython/pull/2204
  • github.com/gitpython-developers/GitPython/releases/tag/3.1.58
  • github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r

Code Behaviors & Features

Detect and mitigate GHSA-9rj7-rf2p-w77r with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 3.1.58

Fixed versions

  • 3.1.58

Solution

Upgrade to version 3.1.58 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Source file

pypi/GitPython/GHSA-9rj7-rf2p-w77r.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 08 Aug 2026 00:18:54 +0000.