CVE-2026-76218
High · 7.5CVSS
7.5
EPSS
0.8%
Published
Aug 19, 2026
CISA due date
—
The record
GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79675 NLTK before 3.10.3 fails to validate JVM options passed through the per-call options… CWE-88
- CVE-2026-78676 GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during… CWE-88
- CVE-2026-78678 GitPython versions before 3.1.59 contain an incomplete denylist in the… CWE-88
- CVE-2026-76219 GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in… CWE-88
- CVE-2026-76220 GitPython before 3.1.58 contains a command execution vulnerability in the… CWE-88
- CVE-2026-73624 GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the… CWE-88
- CVE-2026-73621 GitPython before 3.1.56 contains an argument injection vulnerability in the… CWE-88
- CVE-2026-54088 File Browser is a file managing interface for uploading, deleting, previewing, renaming… CWE-88