CVE-2026-87817: Improper Control of Generation of Code ('Code Injection') in gitpython-developers GitPython
Affects gitpython-developers GitPythonSource CVE Database V5
- ghsa-2pxq-5vcg-rq29
- oesa-2026-4026
- openeuler-24-03-lts-sp3
- oesa-2026-4025
- openeuler-24-03-lts-sp1
- brew-tach-cve-2026-87817
- homebrew
- brew-opentimestamps-client-cve-2026-87817
- brew-legit-cve-2026-87817
- brew-gitup-cve-2026-87817
- brew-apm-cve-2026-87817
- brew-nbdime-cve-2026-87817
- brew-dstack-cve-2026-87817
- brew-mk-cve-2026-87817
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 33% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| gitpython-developersGitPython | Affected
| Fixed in
|
PyPIgitpythonpkg:pypi/gitpythonOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade GitPython to version 3.1.60 or later, where this vulnerability is fixed. Patch status is confirmed by the versioning information indicating that versions before 3.1.60 are affected and the issue is resolved in 3.1.60. No vendor advisory content was provided, so check the official GitPython release notes or security advisories for confirmation.
Description
GitPython versions before 3.1.60 contain a code injection vulnerability due to improper validation of the git directory location. This flaw allows attackers to impersonate the git directory by manipulating tracked files such as gitdir, commondir, and HEAD. Exploitation can lead to arbitrary code execution when a victim calls index.commit() on a cloned or opened repository with a malicious pre-commit hook.
Impact
Successful exploitation allows an attacker to execute arbitrary code in the context of the user running GitPython. This can lead to compromise of the victim system or environment where the repository is used. The vulnerability does not require privileges or user interaction beyond invoking index.commit().
Summary
CVE-2026-87817 is a high-severity vulnerability in GitPython prior to version 3.1.60. The vulnerability arises from insufficient validation of the git directory location, enabling attackers to spoof the git directory using tracked files like gitdir, commondir, and HEAD. By placing a malicious pre-commit hook in the tracked hooks directory, an attacker can achieve arbitrary code execution triggered by the victim invoking index.commit() on the affected repository.