Executive brief
GitPython's clone_from() and clone() methods are missing a safety check for the --separate-git-dir option, which allows attackers to redirect Git repository metadata (the .git directory) to arbitrary filesystem paths outside the intended clone destination. An attacker who can control the separate_git_dir parameter can create malicious Git hook directories at arbitrary locations, potentially leading to arbitrary code execution if those hooks are later executed by other Git operations.
Technical details
The vulnerability exists because Repo.unsafe_git_clone_options (the denylist checked before executing git clone) does not include --separate-git-dir, despite the parallel denylist Repo.unsafe_git_init_options correctly blocking it for git init, and despite the clone() docstring explicitly documenting it as unsafe when allow_unsafe_options=False (the default). The git clone command accepts --separate-git-dir=<path> to redirect the entire .git metadata directory to an attacker-controlled path, leaving only a gitlink file at the intended destination. An attacker who can pass a separate_git_dir kwarg into Repo.clone_from() or Repo.clone() bypasses the denylist check and causes GitPython to execute git clone --separate-git-dir=<attacker-path> via subprocess. This allows creation of arbitrary directory trees (including hooks/ subdirectories) at any writable filesystem path, and can collide with existing repositories or shared caches to contaminate their metadata. If a later Git operation runs against the redirected directory, attacker-planted hooks can execute arbitrary code. No authentication is required; this affects any application that forwards caller-influenced separate_git_dir values to the clone API without its own validation. A patch is available in GitPython 3.1.59.
Affected products
- GitPython GitPython < 3.1.59
Timeline
- 2026-08-10: disclosed: Original advisory GHSA-8mcc-hrx5-hvxc published
- 2026-08-25: advisory: Duplicate advisory GHSA-7r39-6q8m-qw68 published
- 2026-08-10: patched: GitPython 3.1.59 released with patch