CVE-2026-87817
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-94
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- gitpython-developers GitPython
- gitpython-developers GitPython
Weakness type
Related vulnerabilities
- CVE-2026-19584 — Velociraptor VQL injection during notebook restore from backup
- CVE-2026-87926 — Rizwan17 inventory-management-system Login Page index.php cross site scripting
- CVE-2026-87923 — Rizwan17 inventory-management-system List DBOperation.php cross site scripting
- CVE-2026-41870 — Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)
- CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
- CVE-2026-86076 — n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution
- CVE-2026-86083 — n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
- CVE-2026-85983 — Local Privilege Escalation in Auth0 AD/LDAP Connector