CVE-2026-76218
High
Description
GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.
SeverityHigh
CVSS7.5
Exploit probability—
ProductGitpython
PublishedAug 19, 2026
First seenAug 19, 2026
Weakness typeCWE-88CWE-88
How to fix
Update
- gitpython_project gitpython3.1.58 or later
- gitpython3.1.58 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitpython_project gitpython | v < 3.1.58 | 3.1.58 |
| gitpythonPyPI | v < 3.1.58 | 3.1.58 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.