Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-08-19T14:02:02
gitpython: GitPython: Remote Code Execution via malicious Git hooks
7.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-94
GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.
A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the `Repo.init` function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on the initialized repository, these hooks execute arbitrary code, leading to a complete compromise of the affected system.
GitPython's Repo.init forwards an unvalidated template parameter, letting an attacker who controls that parameter point at a directory of malicious git hooks that execute on subsequent git operations (RCE), fixed in 3.1.58. Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose the Repo.init template/options parameters to adversary-controlled input; the vulnerable parameter cannot be controlled by an attacker in these products, so they are marked not affected. GitPython as shipped in Red Hat OpenStack Platform 16.2 and 17.1 contains the vulnerable library code and retains its affected determination.
Do not pass untrusted or attacker-influenced input as the template parameter (or other forwarded options) to GitPython's Repo.init. Upgrade to GitPython 3.1.58 or later, where the unsafe option forwarding is fixed.
Red Hat Satellite 6.19 for RHEL 9
2026-09-03T00:00:00Z
RHSA-2026:63385
python3.12-gitpython-0:3.1.59-1.el9pc
Red Hat Satellite 6.19 for RHEL 9
2026-09-03T00:00:00Z
RHSA-2026:63385
python3.12-gitpython-0:3.1.59-1.el9pc
Red Hat Satellite 6.18
2026-09-17T00:00:00Z
RHSA-2026:68764
satellite/iop-vmaas-rhel9:1789611858
Red Hat Satellite 6.18
2026-09-17T00:00:00Z
RHSA-2026:68771
satellite/iop-vulnerability-engine-rhel9:1789637082
Red Hat Satellite 6.19
2026-09-17T00:00:00Z
RHSA-2026:68776
satellite/iop-vulnerability-engine-rhel9:1789607605
Red Hat Satellite 6.19
2026-09-17T00:00:00Z
RHSA-2026:68780
satellite/iop-vmaas-rhel9:1789611998
Exploit Intelligence
Not affected
exploit-intelligence-tech-preview/vulnerability-analysis-rhel9
Exploit Intelligence
Not affected
exploit-intelligence/vulnerability-analysis-rhel9
Migration Toolkit for Applications 8
Not affected
mta/mta-solution-server-rhel9
Pen Drive Powered by Red Hat Lightspeed
Not affected
pen-drive/pen-drive-scanner-rhel9
Red Hat AI Inference Server
Not affected
rhaiis/vllm-cpu-rhel9
Red Hat AI Inference Server
Not affected
rhaiis/vllm-tpu-rhel9
Red Hat Ansible Automation Platform 2
Will not fix
ansible-automation-platform-24/controller-rhel8
Red Hat Ansible Automation Platform 2
Will not fix
ansible-automation-platform-24/hub-rhel8
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-25/controller-rhel8
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-25/hub-rhel8
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-26/controller-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/hub-rhel9
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-27/controller-rhel9
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-27/hub-rhel9
Red Hat Ansible Automation Platform 2
Not affected
python3.11-gitpython
Red Hat Ansible Automation Platform 2
Not affected
python3.12-gitpython
Red Hat Ansible Automation Platform 2
Not affected
python3x-gitpython
Red Hat Ansible Automation Platform 2
Not affected
python-gitpython
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/disk-image-cuda-rhel9
Red Hat Hardened Images
Not affected
llvm
Red Hat Hardened Images
Not affected
llvm21
Red Hat Hardened Images
Not affected
rust
Red Hat Hardened Images
Not affected
swift-lang
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-feature-server-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th-torch-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th-torch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th-torch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-training-cuda128-torch29-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-trustyai-nemo-guardrails-server-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Red Hat OpenStack Platform 16.2
Not affected
GitPython
Red Hat OpenStack Platform 16.2
Not affected
rhosp-rhel8/openstack-mistral-api
Red Hat OpenStack Platform 16.2
Not affected
rhosp-rhel8/openstack-mistral-base
Red Hat OpenStack Platform 16.2
Not affected
rhosp-rhel8/openstack-mistral-engine
Red Hat OpenStack Platform 16.2
Not affected
rhosp-rhel8/openstack-mistral-event-engine
Red Hat OpenStack Platform 16.2
Not affected
rhosp-rhel8/openstack-mistral-executor
Red Hat OpenStack Platform 16.2
Not affected
rhosp-rhel8/openstack-nova-scheduler
Red Hat OpenStack Platform 16.2
Not affected
rhosp-rhel8/openstack-tripleoclient
Red Hat OpenStack Platform 17.1
Not affected
GitPython
Red Hat Satellite 6
Affected
python-gitpython
https://www.cve.org/CVERecord?id=CVE-2026-76218
https://nvd.nist.gov/vuln/detail/CVE-2026-76218
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r
https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init