GitPython path traversal in clone_from() and clone() via --separate-git-dir

Severity: high · CVSS 7.5 · Published 2026-08-25

GitPython's clone_from() and clone() methods are missing a safety check for the --separate-git-dir option, which allows attackers to redirect Git repository metadata (the .git directory) to arbitrary filesystem paths outside the intended clone destination. An attacker who can control the separate_git_dir parameter can create malicious Git hook directories at arbitrary locations, potentially leading to arbitrary code execution if those hooks are later executed by other Git operations.

Technologies: Gitpython Project Gitpython. Vendors: Gitpython Project.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.5, published 25 August 2026.
Which products and versions are affected?
Gitpython Project Gitpython < 3.1.59.
Is there a fix for This vulnerability?
A patch was published on 2026-08-10: GitPython 3.1.59 released with patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Gitpython Project Gitpython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists because Repo.unsafe_git_clone_options (the denylist checked before executing git clone) does not include --separate-git-dir, despite the parallel denylist Repo.unsafe_git_init_options correctly blocking it for git init, and despite the clone() docstring explicitly documenting it as unsafe when allow_unsafe_options=False (the default). The git clone command accepts --separate-git-dir=&lt;path&gt; to redirect the entire .git metadata directory to an attacker-controlled path, leaving only a gitlink file at the intended destination. An attacker who can pass a separate_git_dir kwarg into Repo.clone_from() or Repo.clone() bypasses the denylist check and causes GitPython to execute git clone --separate-git-dir=&lt;attacker-path&gt; via subprocess. This allows creation of arbitrary directory trees (including hooks/ subdirectories) at any writable filesystem path, and can collide with existing repositories or shared caches to contaminate their metadata. If a later Git operation runs against the redirected directory, attacker-planted hooks can execute arbitrary code. No authentication is required; this affects any application that forwards caller-influenced separate_git_dir values to the clone API without its own validation. A patch is available in GitPython 3.1.59.

Affected products

  • GitPython GitPython < 3.1.59

Timeline

  • 2026-08-10: disclosed: Original advisory GHSA-8mcc-hrx5-hvxc published
  • 2026-08-25: advisory: Duplicate advisory GHSA-7r39-6q8m-qw68 published
  • 2026-08-10: patched: GitPython 3.1.59 released with patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.