Arbitrary Code Injection Affecting gitpython package, versions [,3.1.58)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-GITPYTHON-18592312
- published8 Aug 2026
- disclosed7 Aug 2026
- creditmanus-use, BarakSrour
Introduced: 7 Aug 2026
New CVE NOT AVAILABLE CWE-88 (opens in a new tab)How to fix?
Upgrade GitPython to version 3.1.58 or higher.
Overview
GitPython is a python library used to interact with Git repositories
Affected versions of this package are vulnerable to Arbitrary Code Injection via the Repo.init process. An attacker can execute arbitrary code by supplying a malicious template parameter that points to a directory containing executable git hooks, which are then copied into the repository and triggered on subsequent git operations. This is only exploitable if the application forwards a user-controlled template argument and the attacker is able to stage an executable hook directory at a known path.