Remote Code Execution Vulnerability in GitPython by GitHub

CVE-2026-87817

What is CVE-2026-87817?

The GitPython library, prior to version 3.1.60, is susceptible to a vulnerability that compromises the validation process of the git directory location. This flaw permits attackers to mimic the git directory by utilizing tracked files such as gitdir, commondir, and HEAD. By placing a harmful pre-commit hook in the monitored hooks directory, malicious actors can execute arbitrary code whenever a user invokes index.commit() on a cloned or opened repository, leading to potential exploitation.

References