Skip to main content

GitPython CVE-2026-78677

| EUVDEUVD-2026-65223 HIGH
Path Traversal (CWE-22)
2026-08-25 VulnCheck GHSA-7r39-6q8m-qw68 GHSA-8mcc-hrx5-hvxc PYSEC-2026-3787
Path Traversal Red Hat Suse Gitpython Gitpython Developers
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.3 CRITICAL

Network vector reflects worst-case exposed application; S:C and I:H capture hook execution crossing process boundary; C:L acknowledges limited read side-effect from hooks.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 25, 2026 - 03:16 EUVD
Analysis Generated
Aug 25, 2026 - 02:30 vuln.today
CVE Published
Aug 25, 2026 - 01:30 cve.org
HIGH 8.7

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 16 pypi packages depend on gitpython (13 direct, 3 indirect)

Ecosystem-wide dependent count for version 3.1.59.

DescriptionCVE.org

GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, enabling arbitrary directory creation and potential hook execution.

AnalysisAI

Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. The library's clone operations omit --separate-git-dir from the unsafe_git_clone_options blocklist, so any application that passes attacker-controlled values to Repo.clone_from() or Repo.clone() allows git to redirect repository metadata to an arbitrary filesystem path. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the path-traversal primitive combined with git-hook execution capability produces a realistic high-integrity-impact scenario in exposed applications.

Technical ContextAI

GitPython is a Python library for programmatic git repository access. It maintains an unsafe_git_clone_options list as a defense-in-depth control to block dangerous git options during clone operations, preventing path traversal and injection. The --separate-git-dir git option, which instructs git to store the .git metadata directory at a filesystem path separate from the working tree, was omitted from that list - the CWE-22 (Path Traversal) root cause. Because git writes the metadata directory to wherever --separate-git-dir points, an attacker who controls the separate_git_dir parameter can direct that write to any path writable by the process, escaping the intended clone destination. The affected CPE is cpe:2.3:a:gitpython-developers:gitpython:*:*:*:*:*:*:*:*, covering every version before 3.1.59. If git hooks are subsequently created or already exist at the redirected path, git operations may trigger arbitrary command execution within the process's security context.

RemediationAI

Upgrade GitPython to version 3.1.59 or later, which adds --separate-git-dir to the unsafe_git_clone_options blocklist, closing the bypass. The vendor advisory is at https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc. If an immediate library upgrade is not feasible, applications should explicitly reject or strip any separate_git_dir keyword argument before passing options to Repo.clone_from() or Repo.clone() - note this is a fragile compensating control that requires ongoing maintenance as new unsafe options emerge. A more robust interim measure is to switch to an allow-list approach: enumerate only the specific clone options your application legitimately requires and discard all others, which prevents bypass via other currently-unblocked options. Application-level filtering does not protect downstream callers of the library; patching the library is the only complete fix.

More in Gitpython

View all
CVE-2022-24439 CRITICAL POC
9.8 Dec 06

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
CVE-2023-40590 HIGH POC
7.8 Aug 28

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
CVE-2026-78679 HIGH POC
7.1 Aug 25

Arbitrary file read in GitPython before 3.1.59 allows low-privileged remote attackers to exfiltrate sensitive files by s
CVE-2023-41040 MEDIUM POC
6.5 Aug 30

GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
CVE-2023-40267 CRITICAL
9.8 Aug 11

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
CVE-2026-78676 CRITICAL POC
9.3 Aug 25

Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
CVE-2026-67324 CRITICAL
9.3 Aug 01

Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
CVE-2026-67325 HIGH POC
8.7 Aug 01

Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
CVE-2026-42215 HIGH POC
8.8 May 07

Command injection in GitPython 3.1.30-3.1.46 allows remote authenticated attackers to execute arbitrary commands via und
CVE-2026-67323 HIGH POC
8.6 Aug 01

Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
CVE-2026-73625 HIGH
8.7 Aug 13

Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
CVE-2026-76220 HIGH POC
8.7 Aug 19

Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected

Share

CVE-2026-78677 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy