Path Traversal Vulnerability in GitPython by GitPython Developers

CVE-2026-78677

What is CVE-2026-78677?

A vulnerability in GitPython versions prior to 3.1.59 allows attackers to exploit the omission of the --separate-git-dir parameter from unsafe_git_clone_options. This flaw enables the unauthorized creation of arbitrary git directories outside the designated clone destination. By manipulating the separate_git_dir parameter in Repo.clone_from() or Repo.clone(), attackers can redirect repository metadata to a location controlled by them, facilitating arbitrary directory creation and the potential execution of malicious hooks. This could pose significant security risks for users relying on this library.

References