CVE-2026-76218 is a high-severity vulnerability in GitPython prior to version 3.1.58. The issue is due to improper neutralization of argument delimiters in the Repo.init method, which forwards unsafe git options without validation. An attacker can exploit this by providing a crafted template parameter that references a directory with malicious git hooks. When git operations are performed on the repository initialized with this template, the hooks execute arbitrary code, leading to remote code execution.

Successful exploitation allows an attacker with partial privileges to execute arbitrary code on the system where the vulnerable GitPython library is used. This can lead to full compromise of the affected environment depending on the privileges of the GitPython process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input for the template parameter in Repo.init or restrict usage to trusted sources only.