CVE-2026-76218
HighCVSS 7.5Summary
GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.
Risk Assessment
Risk of remote code execution in environments using GitPython, potentially leading to full system compromise or data breach.
Recommendation
Update GitPython to version 3.1.58 or later. Restrict trust in parameters passed to Repo.init and do not use untrusted data as template.
Original NVD description (English source)
GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.