Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-87817: GitPython < 3.1.60 may run attacker code via fake repo
CVE-2026-87817 · published 1 month ago
Summary
Versions of GitPython older than 3.1.60 do not correctly check the location of a repository's internal files. An attacker who can place specially crafted files in a repository can cause the library to run their own code when a commit is made. Update GitPython to version 3.1.60 or later, and avoid using untrusted repositories.
What to do
- Update debian python-git to version 3.1.61-1.
- Update gitpython to version 3.1.60.
- Update gitpython-developers gitpython to version 3.1.60 or later.
- Update gitpython_project gitpython to version 3.1.60 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | python-git | All versions |
| Debian:14 | debian | python-git |
< 3.1.61-1 Fix: upgrade to 3.1.61-1
|
| Ubuntu:Pro:14.04:LTS | canonical | python-git | All versions |
| – | gitpython-developers | gitpython | < 3.1.60 |
| – | gitpython_project | gitpython |
< 3.1.60 cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* |
| PyPI | – | gitpython |
< 3.1.60 Fix: upgrade to 3.1.60
|
| pip | – | gitpython |
<= 3.1.59 Fix: upgrade to 3.1.60
|
Original advisory text
GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.
References
- https://github.com/advisories/GHSA-239g-whfq-7xj9
- https://ubuntu.com/security/CVE-2026-87817 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-87817 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87817... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-87817 Vendor Advisory
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-... Exploit Mitigation Vendor Advisory
- https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-executi... Third Party Advisory
- https://github.com/gitpython-developers/GitPython/pull/2218
- https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f...
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60
- https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3...
- https://security-tracker.debian.org/tracker/CVE-2026-87817 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-94Code Injection
CWE-427Uncontrolled Search Path Element
Timeline
Published9 Sep 2026
Updated11 Oct 2026
First seen9 Sep 2026
Sources
CVE-2026-87817 · OSV
GHSA-239g-whfq-7xj9 · GHSA
CVE-2026-87817 · NVD
DEBIAN-CVE-2026-87817 · OSV
UBUNTU-CVE-2026-87817 · OSV
CVE-2026-87817 · MITRE
PYSEC-2026-3982 · OSV
Track software like this
Free during beta