Fluid Attacks Database

Description

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	python-git	=3.1.30-1 \|\| =3.1.30-1+deb12u2 \|\| =3.1.36-1 \|\| =3.1.37-1 \|\| =3.1.37-2 \|\| =3.1.37-3 \|\| =3.1.44-1 \|\| =3.1.45-1 \|\| =3.1.46-1 \|\| =3.1.50-1 \|\| =3.1.61-1 \|\| =3.1.62-1 \|\| =3.1.62-2	-
debian 13	python-git	=3.1.44-1 \|\| =3.1.45-1 \|\| =3.1.46-1 \|\| =3.1.50-1 \|\| =3.1.61-1 \|\| =3.1.62-1 \|\| =3.1.62-2	-
debian 14	python-git	=3.1.44-1 \|\| =3.1.45-1 \|\| =3.1.46-1 \|\| =3.1.50-1 \|\| >=0 <3.1.61-1	3.1.61-1
pypi	gitpython	>=0 <3.1.58	3.1.58

Aliases

1. CVE-2026-762182. NVD-2026-762183. OSV-DEBIAN-2026-762184. OSV-2026-762185. GHSA-9rj7-rf2p-w77r6. GCVE-2026-762187. SECURITY-TRACKER-CVE-2026-76218

References

1. https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r2. https://github.com/gitpython-developers/GitPython/pull/22043. https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc664. https://github.com/gitpython-developers/GitPython/releases/tag/3.1.585. https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.