PYSEC-2026-3787

    Dashboard / Vulnerabilities / PYSEC-2026-3787

    PYSEC-2026-3787

    Published: 25 Aug 2026Last Modified: 3 Sept 2026

    Summary:

    Details: GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, enabling arbitrary directory creation and potential hook execution.

    References: https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir, https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc

    Affected packages

    Package

    Name: gitpython

    Purl: pkg:pypi/gitpython

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.1.59

    Affected versions

    0.1.7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2026-3787 | CVE-DB