High severity8.8NVD Advisory· Published Sep 9, 2026· Updated Sep 16, 2026
CVE-2026-87817
CVE-2026-87817
Description
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
gitpythonPyPI | < 3.1.60 | 3.1.60 |
Affected products
3<3.1.60+ 1 more
- (no CPE)range: <3.1.60
- (no CPE)range: <3.1.60
Patches
Vulnerability mechanics
References
8- github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9nvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-239g-whfq-7xj9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-87817ghsaADVISORY
- www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonationnvdThird Party AdvisoryWEB
- github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0bghsaWEB
- github.com/gitpython-developers/GitPython/pull/2218ghsaWEB
- github.com/gitpython-developers/GitPython/releases/tag/3.1.60ghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3982.yamlghsaWEB
News mentions
1- GitPython: Three Vulnerabilities Including RCE and ReDoS Disclosed TogetherVypr Intelligence · Sep 9, 2026