GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the destination. In 3.1.x, _validate_repo_path() does not exist and the call succeeds silently, while in 3.2.0 and later affected revisions the check in git/index/base.py raises ValueError only after the clone has written to disk and does not remove the planted file. An attacker-controlled submodule can therefore place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination such as .git/hooks that is empty enough for Git to clone into it, which commonly means that default sample hooks are absent. This issue is fixed in version 3.2.1.
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules.
GitPython versions before 3.2.0 contain an argument injection vulnerability in the Head.checkout() function. This flaw allows remote attackers to read arbitrary files by supplying a specially crafted branch name that is interpreted as a git option. Specifically, an attacker can host a repository with a default branch named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents via GitCommandError messages.
GitPython versions from 3.1.30 up to but not including 3.2.0 contain a critical remote code execution vulnerability in the Remote.pull() method. The vulnerability arises because the unsafe-option guard only inspects keyword arguments and not positional refspec arguments, allowing attackers controlling the refspec to inject OS commands via the --upload-pack option. This can lead to execution of arbitrary commands as the calling process over local-path or SSH transports.
GitPython versions before 3.2.0 contain a remote code execution vulnerability due to improper validation of input types. The Git.ls_remote function forwards URLs without validating unsafe protocols, allowing attackers to supply malicious ext:: remote-helper URLs to execute commands. Additionally, merge_base and IndexFile.move functions accept unguarded option injection. This vulnerability has a high severity with a CVSS score of 7.7.
GitPython versions before 3.2.0 contain a regular expression denial of service (ReDoS) vulnerability in the _re_actor_epoch pattern used during parsing of author, committer, and tagger lines. This flaw allows attackers to cause excessive CPU consumption by serving repositories with commit or tag objects that have long space-filled lines without valid epoch or timezone information, triggering inefficient regex processing.
GitPython versions prior to 3.2.0 contain an information disclosure vulnerability. This flaw allows maliciously crafted repositories to exploit environment variable expansion in the cloning process, specifically via the separate_git_dir parameter in Repo._clone(). Attackers can use specially named submodules with variable syntax to expose sensitive information from .git/modules directory names and DEBUG logs during clone and submodule update operations.
GitPython versions before 3.1.62 contain a path traversal vulnerability in the handling of the `path` field from untrusted .gitmodules files during submodule updates. This flaw allows directory creation outside the repository working tree, potentially leading to unauthorized file system modifications. The vulnerability requires an application flow that updates submodules at a non-HEAD commit, which is less common. The issue is fixed in GitPython 3.1.62.
GitPython versions before 3.1.60 contain a regular expression denial of service (ReDoS) vulnerability in the Actor.name_email_regex component that processes commit author and committer fields. An attacker can craft a commit object with a malformed author field containing an unterminated angle bracket, causing the regex to perform quadratic backtracking. This results in excessive CPU consumption, potentially exhausting resources for over two minutes per commit access.
GitPython version 3.1.59 contains a vulnerability in its high-level diff API where the --no-index option is not properly restricted. This flaw allows attackers with limited privileges to read arbitrary filesystem paths by using the --no-index option combined with the -I/--ignore-matching-lines flag. This can be exploited as a content-dependent Boolean oracle to extract single-line secrets from local files based on success or error responses.
GitPython versions before 3.1.60 contain a code injection vulnerability due to improper validation of the git directory location. This flaw allows attackers to impersonate the git directory by manipulating tracked files such as gitdir, commondir, and HEAD. Exploitation can lead to arbitrary code execution when a victim calls index.commit() on a cloned or opened repository with a malicious pre-commit hook.
GitPython versions before 3.1.59 contain an arbitrary file read vulnerability in the TagReference.create() function. This flaw allows attackers to bypass an unsafe option guard by supplying a specially crafted positional reference parameter, such as --file=<path>, enabling them to read arbitrary files. The contents of these files are returned in the annotated tag message. The vulnerability has a high severity with a CVSS score of 7.1.
GitPython versions before 3.1.59 have a vulnerability due to an incomplete denylist in the unsafe_git_revision_options guard. This flaw allows attackers to bypass restrictions by using the --contents and -S options with the Repo.blame() method, enabling them to read arbitrary files. By supplying revision values such as --contents=/etc/passwd, attackers can leak file contents through the blame result returned to the caller.
CVE-2026-78677 is a path traversal vulnerability in GitPython before version 3.1.59. It allows attackers to manipulate the separate_git_dir parameter in cloning functions to create arbitrary git directories outside the intended clone destination. This can lead to arbitrary directory creation and potential execution of malicious hooks.
GitPython versions before 3.1.59 contain a critical vulnerability where multi-line git-config values are improperly re-serialized during write operations. This flaw corrupts dormant quoted values into active git directives, such as core.hooksPath, enabling attackers to inject arbitrary commands. Exploitation can lead to arbitrary code execution via hook invocation.
GitPython versions before 3.1.59 contain a vulnerability where the merge_includes feature is not disabled when parsing .gitmodules files. This flaw allows attackers to craft malicious .gitmodules files with include directives that reference arbitrary local file paths. When the repository's submodules are accessed, the GitConfigParser raises an exception that leaks the first line of the targeted file in the error message.
GitPython versions before 3.1.58 contain a path traversal vulnerability due to improper validation of submodule names in .gitmodules files. This flaw allows attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory by using traversal sequences in submodule names. The vulnerability is rated high severity with a CVSS score of 8.4.
GitPython versions before 3.1.58 contain a config-name injection vulnerability that allows attackers to inject malicious git-config directives by including special characters in option names. This can lead to arbitrary command execution via configuration options like core.sshCommand or core.hooksPath during subsequent git operations.
GitPython versions before 3.1.58 contain a command execution vulnerability due to improper neutralization of argument delimiters in command construction. This flaw allows attackers to bypass the check_unsafe_options guard by combining a single-character keyword argument with split_single_char_options set to false. Exploitation can lead to arbitrary OS command execution when using guarded methods such as clone_from with default allow_unsafe_options set to false.
GitPython versions before 3.1.58 have an arbitrary file overwrite vulnerability due to improper neutralization of argument delimiters in certain methods. This allows attackers to inject the --index-output option into git commands, enabling overwriting of arbitrary files with git-index blobs at writable paths controlled by the attacker.