Kimi cli: GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution (CVE-2026-87817)

GitPython's Repo.__init__ method determines the git directory by testing candidate paths in an order that considers the real .git directory last. Early tests check for tracked files named gitdir, commondir, and HEAD, which are legal tracked files in git repositories. Because GitPython resolves git_dir to the working-tree root when these files exist, it treats attacker-controlled files as if they were inside the git directory, including hooks that it executes. This leads to arbitrary code execution when index.commit() is called. The vulnerability also allows reading files outside the repository via config includes and writing config files to attacker-chosen directories. The issue is present in GitPython 3.1.59 and was demonstrated with a proof-of-concept. Real git is unaffected. The vulnerability requires the victim to open or clone an attacker-controlled repository and perform a commit using GitPython. The vendor has provided remediation steps including reordering the directory checks, validating HEAD contents, and disabling merge_includes in config reading.

An attacker controlling a repository that a victim opens or clones with GitPython 3.1.59 can execute arbitrary commands on the victim's system by placing malicious hooks in tracked files that GitPython misinterprets as internal git hooks. Additionally, the attacker can read sensitive files outside the repository by exploiting config includes and write configuration files to arbitrary locations. This can compromise CI runners, code scanning services, mirrors, dependency bots, and AI code-review tools that use GitPython to handle untrusted repositories. The vulnerability does not affect the real git client but only GitPython's library behavior.

A patch is available for this vulnerability. Users should upgrade GitPython to a fixed version that tests the real .git directory before other candidate paths, validates HEAD contents, resolves hook paths correctly, and disables merge_includes in config reading. Until patched, avoid opening or cloning untrusted repositories with GitPython, and do not perform commits via GitPython's index.commit() on such repositories. Follow the vendor's advisory for the official fixed versions and remediation guidance.