GHSA-8MCC-HRX5-HVXC GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

🗓️ 08 Sep 2026 18:41:52Reported by GoogleType

osv🔗 osv.dev👁 3 Views

GitPython clone_from()/clone() omit --separate-git-dir from denylist for arbitrary git-dir creation.

Reporter	Title	Published	Views	Family All 27
AlpineLinux	CVE-2026-78677	25 Aug 202601:30	–	alpinelinux
BDU FSTEC	The vulnerability of the Repo.clone_from() and Repo.clone() functions in the git/repo/base.py module of the Python library for interacting with Git repositories in GitPython allows a malicious actor to write arbitrary files.	27 Aug 202600:00	–	bdu_fstec
Circl	CVE-2026-78677	8 Sep 202620:35	–	circl
CVE	CVE-2026-78677	25 Aug 202601:30	–	cve
Cvelist	CVE-2026-78677 GitPython before 3.1.59 Path Traversal via separate-git-dir	25 Aug 202601:30	–	cvelist
Debian CVE	CVE-2026-78677	25 Aug 202601:30	–	debiancve
EUVD	EUVD-2026-65223	8 Sep 202618:41	–	euvd
Github Security Blog	Duplicate Advisory: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination	25 Aug 202603:32	–	github
Github Security Blog	GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination	8 Sep 202618:41	–	github
NVD	CVE-2026-78677	25 Aug 202602:16	–	nvd

Source	Link
github	www.github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-78677
github	www.github.com/gitpython-developers/GitPython/pull/2210
github	www.github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d
github	www.github.com/gitpython-developers/GitPython
github	www.github.com/gitpython-developers/GitPython/releases/tag/3.1.59
github	www.github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3787.yaml
vulncheck	www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir

08 Sep 2026 19:00Current

CVSS 3.17.5

CVSS 48.7

EPSS0.0043

GitPython path traversal unsafe clone options clone_from git-directory