Skip to main content

GitPython CVE-2026-76218

| EUVDEUVD-2026-62459 HIGH
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
2026-08-19 VulnCheck GHSA-298h-jpq4-m665
RCE Gitpython Suse
7.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.7 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network vector because the trigger path is remote application input; AC:H and PR:L because two preconditions (kwarg influence plus staged hook path) require low-privilege app access but non-trivial setup.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 19, 2026 - 15:17 EUVD
Source Code Evidence Fetched
Aug 19, 2026 - 14:51 vuln.today
Analysis Generated
Aug 19, 2026 - 14:51 vuln.today
CVE Published
Aug 19, 2026 - 14:02 cve.org
HIGH 7.7

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 20 pypi packages depend on gitpython (13 direct, 7 indirect)

Ecosystem-wide dependent count for version 3.1.58.

DescriptionCVE.org

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.

AnalysisAI

Remote code execution in GitPython before 3.1.58 is reachable through Repo.init(), which forwards all keyword arguments verbatim to git init without any unsafe-option validation. An attacker who can influence the template kwarg can point it at an attacker-controlled directory containing malicious git hooks; git copies those hooks into the newly initialized repository, and the next git operation (e.g., a commit) triggers arbitrary code execution at the privilege level of the host process. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Attacker stages executable hook at controlled path
Delivery
Authenticated attacker submits template path as application input
Exploit
Application passes template kwarg to Repo.init() unguarded
Execution
git init --template copies hook into .git/hooks/
Persist
Next git operation triggers hook execution
Impact
Arbitrary code runs as host process
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two specific preconditions must both be satisfied: first, the application must invoke Repo.init() with a template kwarg whose value is attacker-influenced - this requires either direct user input reaching the kwarg or indirect control through configuration, job parameters, or repository metadata. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.7 (AV:N/AC:H/AT:P/PR:L) correctly reflects meaningful exploitation barriers: the attacker must supply a controlled template kwarg (requiring some degree of influence over application behavior) AND must have an executable hook directory staged at a reachable path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A developer platform or CI/CD service uses GitPython to initialize repositories from user-submitted job configurations, and a user-controlled field (e.g., a template path parameter) is passed as a kwarg to Repo.init(). An attacker submits a job pointing template at a pre-staged directory containing a malicious post-commit hook script; GitPython calls git init --template=/attacker/path, git copies the hook into the new repo's .git/hooks/, and the next automated git commit in the pipeline executes the hook as the CI service account. …
Remediation Upgrade GitPython to version 3.1.58 or later; this is the primary fix, resolving the missing unsafe-option guard in Repo.init(). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all applications using GitPython and disable or restrict access to Repo.init() with user-supplied parameters; implement firewall rules to prevent untrusted sources from reaching systems running affected versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Gitpython

View all
CVE-2022-24439 CRITICAL POC
9.8 Dec 06

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
CVE-2023-40590 HIGH POC
7.8 Aug 28

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-41040 MEDIUM POC
6.5 Aug 30

GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
CVE-2023-40267 CRITICAL
9.8 Aug 11

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
CVE-2026-78676 CRITICAL
9.3 Aug 25

Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
CVE-2026-67324 CRITICAL
9.3 Aug 01

Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
CVE-2026-67325 HIGH
8.7 Aug 01

Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
CVE-2026-67323 HIGH
8.6 Aug 01

Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
CVE-2026-73625 HIGH
8.7 Aug 13

Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
CVE-2026-76220 HIGH
8.7 Aug 19

Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using

CVE-2026-78677 HIGH
8.7 Aug 25

Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
CVE-2026-76221 HIGH
8.7 Aug 19

Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution vi

Same weakness CWE-88 – Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

View all
CVE-2016-10033 CRITICAL POC
9.8
CVE-2026-24061 CRITICAL POC
9.8
CVE-2025-57791 MEDIUM POC
6.9
CVE-2018-17456 CRITICAL POC
9.8
CVE-2018-19518 HIGH POC
7.5
CVE-2025-70327 CRITICAL POC
9.8
CVE-2020-5792 HIGH POC
7.2
CVE-2024-39930 CRITICAL POC
9.9

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-76218 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy