CVE-2026-87817: GitPython RCE Vulnerability

CVE-2026-87817 Overview

CVE-2026-87817 is a remote code execution vulnerability in GitPython versions before 3.1.60. The library fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker who controls a repository can place a malicious pre-commit hook in a tracked hooks directory. When a victim clones or opens the repository and calls index.commit(), the hook executes with the victim's privileges. The flaw is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Attackers can achieve arbitrary code execution on developer or CI/CD systems that process a malicious repository through GitPython.

Affected Products

GitPython versions prior to 3.1.60
Python applications and scripts that use GitPython to clone or open untrusted repositories
CI/CD pipelines and developer tooling that automate commits via GitPython

Discovery Timeline

2026-09-09 - CVE-2026-87817 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87817

Vulnerability Analysis

GitPython is a Python library used to interact with Git repositories programmatically. The vulnerability stems from insufficient validation of the effective git directory when the library resolves repository metadata. A standard Git repository stores hooks, references, and configuration inside the .git directory, which is normally outside the tracked working tree. GitPython trusts pointer files such as gitdir, commondir, and HEAD when locating this directory. An attacker can commit these files into the working tree of a repository so that GitPython resolves the git directory to an attacker-controlled path inside the tracked tree.

Once the git directory points at a tracked location, an attacker-supplied hooks/pre-commit script becomes the executable hook that Git invokes during commit operations. Any downstream consumer that opens the repository with GitPython and performs index.commit() triggers code execution.

Root Cause

The root cause is missing validation of the resolved git directory path against the working tree. GitPython treats attacker-controllable tracked files as authoritative for locating the repository's metadata. This violates the trust boundary between committed content and repository administrative state.

Attack Vector

Exploitation requires an attacker to publish or share a crafted Git repository and requires the victim to perform an action such as opening the repository and invoking index.commit() through GitPython. The attack is network-reachable because repositories are typically distributed over Git hosting services. User interaction, such as cloning a repository and running automation, is required. See the GitHub Security Advisory GHSA-239g-whfq-7xj9 and the VulnCheck Advisory on GitPython for additional technical details.

// No verified exploit code is published for this advisory.
// Refer to the GitHub Security Advisory and VulnCheck writeup for reproduction details.

Detection Methods for CVE-2026-87817

Indicators of Compromise

Presence of tracked files named gitdir, commondir, or HEAD inside the working tree of a cloned repository.
Tracked hooks/ directories containing executable pre-commit, post-commit, or similar Git hook scripts.
Unexpected child processes spawned by Python interpreters running GitPython during index.commit() calls.

Detection Strategies

Inspect repositories before automated processing for tracked files that mimic Git internal metadata.
Monitor CI/CD runners and developer workstations for process trees where python or git spawns shells, curl, wget, or compilers shortly after a commit operation.
Audit installed GitPython versions across build agents and developer laptops and flag any installation earlier than 3.1.60.

Monitoring Recommendations

Enable command-line logging on hosts that execute Git automation and forward events to a centralized log store for correlation.
Alert on writes to .git/hooks/ or tracked hooks/ paths during automated Git operations.
Track outbound network connections from CI runners immediately after repository clone or commit events.

How to Mitigate CVE-2026-87817

Immediate Actions Required

Upgrade GitPython to version 3.1.60 or later on all systems, including developer workstations, build servers, and container images.
Audit dependency manifests such as requirements.txt, pyproject.toml, and Pipfile.lock for pinned GitPython versions below 3.1.60.
Restrict GitPython automation to trusted repositories until patching is complete.

Patch Information

The GitPython maintainers released version 3.1.60, which validates the resolved git directory location and rejects tracked files that attempt to impersonate repository metadata. Details are available in the GitHub Security Advisory GHSA-239g-whfq-7xj9.

Workarounds

Avoid calling index.commit() on repositories from untrusted sources when running vulnerable versions.
Run GitPython automation in ephemeral, sandboxed containers with no network egress and no access to sensitive credentials.
Pre-scan cloned repositories for tracked gitdir, commondir, HEAD, or hooks/ entries and reject any repository that contains them.

bash

# Upgrade GitPython to a fixed release
pip install --upgrade 'GitPython>=3.1.60'

# Verify the installed version
python -c "import git; print(git.__version__)"