CVE-2026-78677

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59

Description GitPython fails to include the --separate-git-dir flag in its unsafe git clone options. This allows an attacker to provide a separate git dir parameter to the Repo.clone from() or Repo.clone() functions, redirecting repository metadata to an arbitrary filesystem path. This behavior can lead to the creation of unauthorized directories and the potential execution of git hooks, which are scripts that run automatically when certain events occur in a git repository.

Recommendations Update GitPython to version 3.1.59 or later.