HIGH 8.7 NVD
CVE-2026-87817
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitd
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.
References
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9
- https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-09-09 via NVD.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.