CVE-2026-87817: gitpython_project gitpython Code Injection
Vulnerability summary
CVE-2026-87817 is a high (CVSS 8.8) Code Injection vulnerability in gitpython_project gitpython. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 1 · Downstream 8 · Related 2Timeline
- 09-09-2026PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.
CVSS metrics
9 scores · 6 sources · 2 versions- OSV · PypiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
+0.08 pp
From 0.33% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundGitpython
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard6 products
- awx< 24.6.1-r64
- nemo-rl-cuda-13.0< 0.7.0-r2
- nemo-rl-cuda-13.0-automodel< 0.7.0-r2
- nemo-rl-cuda-13.0-mcore< 0.7.0-r2
- nemo-rl-cuda-13.0-sglang< 0.7.0-r2
Debian1 product
- python-gitAll versions (No fix recorded) | < 3.1.61-1
Gitpython_project1 product
- gitpython< 3.1.60
Gitpython-developers1 product
- gitpython< 3.1.60
PyPI1 product
- gitpython< 3.1.60
Ubuntu1 product
- python-gitAll versions (No fix recorded)
6 vendors · 11 products
References
12 links- github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9Vendor AdvisoryWEBEVIDENCEREPORTAdvisoryExploitMitigation
