CVE-2026-87817

🚨High - GitPython Git Directory Impersonation Code Execution (CVE-2026-87817)

GitPython versions before 3.1.60 fail to properly validate that a repository's git directory is legitimate, trusting tracked metadata files like gitdir, commondir, and HEAD without verification. This lets an attacker craft a repository that impersonates its own git directory.

By planting a malicious pre-commit hook inside the tracked hooks directory, the attacker gets it to execute the moment a victim calls index.commit() on the cloned or opened repository - turning a routine commit operation into arbitrary code execution.

Any application, CI pipeline, or script that uses GitPython to clone or open repositories from untrusted sources is exposed.

👉Upgrade to GitPython 3.1.60.