CVE-2026-87817

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.60

Description GitPython fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory, which triggers when a victim calls the index.commit() function on a cloned or opened repository. This issue affects any application, CI pipeline, or script that uses the library to interact with repositories from untrusted sources.

Recommendations Update to version 3.1.60.