CVE-2026-87817: GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Applications using GitPython versions before 3.1.60 are exposed when they clone or open a repository whose tracked files can be attacker-controlled, and then call index.commit() on that repository.
What must an attacker provide for code execution to occur?
The attacker needs to place files such as gitdir, commondir, or HEAD that impersonate the Git directory and provide a malicious pre-commit hook in the tracked hooks directory. The hook executes when the victim invokes index.commit().
Does exploitation require user interaction or authentication?
The supplied severity vector indicates network attack access, low complexity, no privileges required, and user interaction required. The described triggering action is the victim calling index.commit() on the cloned or opened repository.
What version resolves the issue?
GitPython 3.1.60 resolves the issue; versions before 3.1.60 are affected.