CVE-2026-76218CWE-88

CVE-2026-76218

High · published August 19, 2026

CVSS v3.1

7.5

EPSS

Percentile

57.0

In the wild

Unconfirmed

What it is

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 7.7 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00825 · 57.0th percentile
Weakness: CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published: 2026-08-19T18:17Z

Affected products (1)

Product	Versions	Fixed in
gitpython_project/gitpython	< 3.1.58	3.1.58

References (2)

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r · [email protected]https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init · [email protected]

EPSS history

Timeline

19 AUG 14:02Z
GitPython before 3.1.58 Remote Code Execution via Repo.init
cvelistv5