Astra Linux – Vulnerability in python-git

GitPython before version 3.1.54 contains an incomplete list of denylists in the unsafegitcloneoptions function, which omits the --template option. This allows attackers to execute arbitrary commands during cloning operations. Attackers can specify --template to point to a directory containing...

gitpython: GitPython: Remote Code Execution via malicious Git template

A flaw was found in GitPython. An incomplete denylist in the unsafegitcloneoptions function fails to restrict the --template option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations...

gitpython: GitPython: Remote Code Execution via malicious Git template

A flaw was found in GitPython. An incomplete denylist in the unsafegitcloneoptions function fails to restrict the --template option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations...

ROS-20260908-73-0110

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the lack of measures taken to neutralize special elements during the processing of the unsafegitcloneoptions parameter. Exploiting this vulnerability could allow a remote attacker to execute...

Duplicate Advisory: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8mcc-hrx5-hvxc. This link is maintained to preserve external references. Original Description GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary g...

CVE-2026-78677

GitPython before 3.1.59 omits the --separate-git-dir option from its unsafe_git_clone_options list, enabling a path traversal attack. An attacker can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, r...

SUSE CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

GitPython Code Execution

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the lack of measures taken to neutralize special elements during the processing of the unsafegitcloneoptions parameter. Exploiting this vulnerability could allow a remote attacker to execute...

CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

EUVD-2026-57792

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

CVE-2026-73623: Improper Neutralization of Special Elements used in an OS Command

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

Summary GitPython's unsafegitcloneoptions denylist omits --template. git clone --template= copies /hooks/ into the new repository and runs them post-checkout fires during clone, so a caller who can influence clone options can achieve arbitrary command execution in the default...