CVE-2026-78677: CVE-2026-78677: Path Traversal and Arbitrary File Write in GitPython

#security #cve #cybersecurity

CVE-2026-78677: Path Traversal and Arbitrary File Write in GitPython

Vulnerability ID: CVE-2026-78677
CVSS Score: 7.5
Published: 2026-09-08

GitPython prior to version 3.1.59 contains a path traversal vulnerability via parameter injection. The clone denylist did not restrict the --separate-git-dir option, allowing attackers to write repository metadata to arbitrary system paths.

TL;DR

GitPython failed to block the --separate-git-dir parameter during cloning operations, allowing attackers to write arbitrary git repository directories and potentially execute arbitrary code.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22
Attack Vector: Network
CVSS Score: 7.5 (v3.1) / 8.7 (v4.0)
EPSS Score: 0.0043 (0.43%)
Impact: Path Traversal, Remote Code Execution (RCE)
Exploit Status: poc
KEV Status: Not Listed

Affected Systems

GitPython applications performing clone operations with user-influenced arguments
GitPython: < 3.1.59 (Fixed in: 3.1.59)

Code Analysis

Commit: b68afff

Block --separate-git-dir in cloning options to prevent arbitrary path traversal and safely handle internally inside submodules.

@@ -159,6 +159,8 @@ class Repo:
         "-c",
         # Can install hooks that execute during clone:
         "--template",
+        # Redirects the repository metadata to a caller-controlled path:
+        "--separate-git-dir",
         # Fetches from an additional caller-controlled URI:
         "--bundle-uri",
     ]

Exploit Details

VulnCheck: Exploit methodology and context details regarding parameter omission in unsafe_git_clone_options.

Mitigation Strategies

Upgrade the GitPython library package to version 3.1.59 or later.
Sanitize application-level input parameters to verify no options containing separate_git_dir or separate-git-dir are forwarded to the GitPython APIs.
Execute the application environment inside isolated, low-privilege sandboxes to prevent writing files to sensitive host paths.

Remediation Steps:

Identify current installation using 'pip show gitpython'.
Update dependency constraints inside requirements.txt or setup.py to use gitpython>=3.1.59.
Run 'pip install --upgrade gitpython' to apply the updated version.
Audit application endpoints that call Repo.clone() or Repo.clone_from() to guarantee no direct raw dictionaries from untrusted origins are unpacked as keyword arguments.

References

Read the full report for CVE-2026-78677 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community