CVE-2026-78677: GitPython before 3.1.59 Path Traversal via separate-git-dir
GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, enabling arbitrary directory creation and potential hook execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.1.59 - Compensating control
If you cannot upgrade GitPython yet, ensure user-controlled values are not passed into Repo.clone_from() or Repo.clone() parameters such as separate_git_dir, and reject/disable any separate-git-dir/unsafe_git_clone_options inputs.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using GitPython before 3.1.59 are exposed if they call Repo.clone_from() or Repo.clone() with a separate_git_dir parameter that an attacker can influence.
What must an attacker be able to control?
The attacker needs to supply or influence the separate_git_dir value passed to the GitPython clone operation. This can redirect Git metadata outside the intended clone destination to an attacker-controlled filesystem path.
What is the impact of successful exploitation?
An attacker can cause arbitrary Git directories to be created outside the intended clone location. The redirected repository metadata may also enable hook execution.
What should be done if upgrading is not immediately possible?
Do not allow untrusted input to control the separate_git_dir parameter for Repo.clone_from() or Repo.clone(). Restrict clone destinations and Git metadata paths to validated, application-controlled locations.