The vulnerability in GitPython's Repo.init method (CVE-2026-76218) arises because it forwards **kwargs verbatim to 'git init' without checking for unsafe options. Specifically, the '--template' option allows copying attacker-controlled hooks into the new repository's .git/hooks directory, enabling arbitrary code execution on the next git operation. Unlike the clone path, which already has unsafe option guards, Repo.init lacks any such protection. Exploitation requires the attacker to stage an executable hook directory and influence the template argument passed to Repo.init. The issue affects GitPython versions >=3.4.1 and <3.25.0. The recommended fix is to add a check_unsafe_options guard with a denylist including '--template' and '--separate-git-dir'.

Successful exploitation results in arbitrary code execution with the privileges of the host process when the next git operation triggers the malicious hook. The attack complexity is high because the attacker must control the template argument and stage an executable hook directory at a known path. Confidentiality, integrity, and availability impacts are all high due to arbitrary code execution.

A patch is available that introduces a check_unsafe_options guard in Repo.init to block unsafe options such as '--template' and '--separate-git-dir'. Users should upgrade GitPython to a fixed version beyond 3.25.0. Until patched, avoid passing untrusted input to the template argument in Repo.init calls. No other mitigations are indicated by the vendor advisory.