Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. GitPython
  4. ›
  5. GHSA-9rj7-rf2p-w77r

GHSA-9rj7-rf2p-w77r: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

August 7, 2026 (updated September 8, 2026)

Repo.init() forwards **kwargs verbatim to git init with no unsafe-option guard and no allow_unsafe_options parameter. git init --template=<dir> copies <dir>/hooks/* into the new repo’s .git/hooks, so an attacker-controlled template kwarg plants a hook that executes on the next git operation → arbitrary code execution. --template is already recognized as unsafe for clone (it is on unsafe_git_clone_options, and GHSA-6p8h-3wgx-97gf covers the clone path), but Repo.init is a distinct method that never received a guard and needs an independent fix.

References

  • github.com/advisories/GHSA-9rj7-rf2p-w77r
  • github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66
  • github.com/gitpython-developers/GitPython/pull/2204
  • github.com/gitpython-developers/GitPython/releases/tag/3.1.58
  • github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r
  • nvd.nist.gov/vuln/detail/CVE-2026-76218
  • www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init

Code Behaviors & Features

Detect and mitigate GHSA-9rj7-rf2p-w77r with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 3.1.58

Fixed versions

  • 3.1.58

Solution

Upgrade to version 3.1.58 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Source file

pypi/GitPython/GHSA-9rj7-rf2p-w77r.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:57 +0000.