CVE-2026-87817CWE-94code-injection

CVE-2026-87817

High · published September 9, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
33.6
In the wild
Unconfirmed
What it is

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00405 · 33.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-09T16:17Z
Affected products (1)
ProductVersionsFixed in
gitpython_project/gitpython< 3.1.603.1.60
References (2)
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9 · [email protected]https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 11:21Z
    GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
    cvelistv5