GitPython arbitrary code execution via repository shadowing

GitPython 3.1.59 misidentifies the git directory when opening or cloning repositories, allowing attackers to execute arbitrary code via malicious tracked files like hooks/pre-commit. This affects services that process untrusted repositories including CI runners, code scanners, and AI agents.

Disclosed 30 September 2026 · Record updated 1 October 2026

Impact

Arbitrary code execution when victim opens or clones attacker's repository and calls index.commit(); also allows reading files outside repository via config manipulation

Our coverage

A cloaked figure hands a poisoned folder into an unsuspecting builder's arms; hidden triggers spring forth, commanding the builder's hands to move against their will.

Vulnerabilities

GitPython flaw lets hostile repos run code on clone

An advisory published on 30 September 2026 says GitPython 3.1.59 can mistake attacker-controlled files for the git directory, then execute a tracked hook.

30 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-239g-whfq-7xj9