GHSA-7r39-6q8m-qw68High· 7.5▾ TwilightDuplicate Advisory: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-8mcc-hrx5-hvxc. This link is maintained to preserve external references.
GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, enabling arbitrary directory creation and potential hook execution.
gitpython <= 3.1.58Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-78677High· 7.5GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination
GHSA-gq48-pqfc-9p58MediumGitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
GHSA-59cr-6r3x-644wMediumGitPython submodule update path traversal can write outside the repository
CVE-2026-100689Medium· 5.9GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules
CVE-2026-87817High· 8.8GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD
GHSA-3vrx-526r-64rmHigh· 8.2Duplicate Advisory: GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython