SecBoard
Zurück zur CVE-Übersicht

CVE-2026-87817

HIGH(8.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Risk Signal Score22/100 — NIEDRIG
  • CVSS 8.8 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.4%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.

Betroffene Produkte

  • cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*

GitHub Advisories

GHSA-239g-whfq-7xj9HIGH

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

pip/gitpython→ 3.1.60
GitHub Advisory

Referenzen