GitPython CVE-2026-76218

Two specific preconditions must both be satisfied: first, the application must invoke Repo.init() with a template kwarg whose value is attacker-influenced - this requires either direct user input reaching the kwarg or indirect control through configuration, job parameters, or repository metadata. Second, the attacker must have an executable hook file (e.g., post-commit) staged at a filesystem path that the git process can read, meaning the attacker needs either write access to the target host's filesystem or the ability to reference a network-mounted or shared path. Exploitation is further limited by PR:L - the attacker must be an authenticated or at-minimum low-privileged user of the application, not a fully anonymous external party. A git operation (commit, merge, etc.) on the initialized repository must occur after initialization to trigger the hook. Default GitPython installations are NOT vulnerable unless the application explicitly forwards user-supplied values to the template kwarg; applications that call Repo.init() with only hardcoded or validated arguments are not affected.

The CVSS 4.0 score of 7.7 (AV:N/AC:H/AT:P/PR:L) correctly reflects meaningful exploitation barriers: the attacker must supply a controlled template kwarg (requiring some degree of influence over application behavior) AND must have an executable hook directory staged at a reachable path. These two preconditions together justify AC:H and AT:P. Despite those barriers, the availability of a working, independently reproduced proof-of-concept published in the GHSA advisory substantially lowers the practical effort required once preconditions are met. EPSS data was not provided; KEV status is not confirmed. Because exploitation depends on the application forwarding attacker-influenced kwargs to Repo.init(), risk is concentrated in applications that accept user-supplied repository parameters - CI/CD pipelines, code-review automation, and repository hosting platforms are the highest-exposure deployment profiles. No CISA KEV confirmation is present in the input data, so active exploitation in the wild is unconfirmed. The missing EPSS score is a gap; absent that signal, the combination of PR:L authentication requirement and a publicly demonstrated exploit chain suggests this should be treated with urgency by any team running GitPython in a multi-tenant or externally-facing context.

A developer platform or CI/CD service uses GitPython to initialize repositories from user-submitted job configurations, and a user-controlled field (e.g., a template path parameter) is passed as a kwarg to Repo.init(). An attacker submits a job pointing template at a pre-staged directory containing a malicious post-commit hook script; GitPython calls git init --template=/attacker/path, git copies the hook into the new repo's .git/hooks/, and the next automated git commit in the pipeline executes the hook as the CI service account. A working proof-of-concept demonstrating exactly this chain was published in the GHSA advisory.