CVE-2026-87817 is a high-severity code injection vulnerability in GitPython before version 3.1.60. The vulnerability arises from insufficient validation of the git directory location, enabling attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. By placing a malicious pre-commit hook in the tracked hooks directory, an attacker can achieve arbitrary code execution when the victim invokes the index.commit() method on a cloned or opened repository. This vulnerability does not require privileges or user interaction beyond calling index.commit().

Successful exploitation allows an attacker to execute arbitrary code in the context of the user running GitPython by leveraging a malicious pre-commit hook. This can lead to compromise of the victim system or environment where GitPython is used. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted repositories or invoking index.commit() on repositories that may contain malicious hooks. Monitor vendor channels for updates and apply patches promptly once released.