CVE-2026-76218
Received Received - Intake

Remote Code Execution in GitPython via Malicious Git Hooks

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76218
EUVD
EUVD-2026-62459

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gitpython gitpython to 3.1.58 (exc)
gitpython_developers gitpython to 3.1.58 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GitPython before 3.1.58 has a remote code execution vulnerability in Repo.init that forwards unsafe Git options without validation. Attackers can supply a malicious template directory with harmful Git hooks. When Git operations are performed, these hooks execute arbitrary code.

Detection Guidance

Check GitPython version with pip show GitPython. If version is below 3.1.58, the system is vulnerable. Inspect repositories initialized via Repo.init() for unexpected template directories or malicious hooks in .git/hooks.

Impact Analysis

An attacker could execute arbitrary code on your system with the privileges of the GitPython process. This could lead to data theft, system compromise, or further network attacks if the hooks are triggered during normal Git operations.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data confidentiality and integrity requirements in GDPR and HIPAA. Organizations may face compliance violations if exploited, leading to legal and regulatory penalties.

Mitigation Strategies

Upgrade GitPython to version 3.1.58 or later. Review applications using Repo.init() to ensure template arguments are validated and unsafe options are disabled. Remove any untrusted template directories or hooks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76218. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart