Description

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T14:17:48.040Z",
  "pubdate": "2026-08-19T14:17:48.040Z",
  "executiveSummary": "GitPython before version 3.1.58 is vulnerable to a remote code execution flaw within the Repo.init function.\nThe vulnerability arises from the improper forwarding of unsafe git options without adequate validation.\nAttackers can supply a malicious template parameter pointing to a directory containing crafted git hooks.\nWhen subsequent git operations are performed on the newly initialized repository, these hooks execute arbitrary code in the context of the user running the application.\nThis impacts systems utilizing GitPython to programmatically manage git repositories, introducing significant risk if untrusted input is passed to initialization routines.\nExploitation requires the ability to influence the parameters passed to Repo.init, specifically the template configuration, allowing unauthorized code execution without requiring prior authentication depending on the application context.",
  "technicalDetails": "The root cause of the vulnerability lies in the input handling mechanism of the Repo.init function within GitPython.\nSpecifically, the function forwards user-supplied parameters to underlying git commands without sufficient sanitization or validation of unsafe git options.\nThe vulnerable component is the repository initialization routine, specifically handling the template parameter.\nAffected versions include all GitPython releases prior to 3.1.58.\nDuring exploitation, an attacker supplies a malicious template parameter that points to a controlled directory.\nThis directory contains pre-configured, malicious git hooks, such as post-commit or pre-commit scripts.\nWhen GitPython executes the git init command with the malicious template argument, the git hooks from the attacker-controlled directory are copied into the newly initialized repository's .git/hooks directory.\nSubsequent execution of git operations by the application or a user on the initialized repository automatically triggers the execution of these malicious git hooks.\nThis results in arbitrary code execution with the privileges of the process executing the git operations.\nNo authentication or specific privilege level is inherently required by the vulnerability itself, relying entirely on the application's exposure to untrusted input during repository initialization."
}