Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2026-87817GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation

High 8.8

In plain English

A high-severity code injection in GitPython from gitpython-developers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 63.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	python-git	3.1.30-1+deb12u3	DEBIAN-CVE-2026-87817
Debian:13	python-git	3.1.44-1+deb13u1	DEBIAN-CVE-2026-87817
Debian:14	python-git	3.1.61-1	DEBIAN-CVE-2026-87817
PyPI	gitpython	3.1.60	GHSA-239g-whfq-7xj9
PyPI	gitpython	3.1.60	PYSEC-2026-3982

Affected products (as reported)

Vendor	Product	Versions
gitpython-developers	GitPython	0 – before 3.1.60

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-239g-whfq-7xj9) vendor-advisory
VulnCheck Advisory: GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation third-party-advisory