GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

[ Description ]Official description

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.

[ Fixes ]Fixes and patches

• gitpython 3.1.60Fixed version · GitHub Advisories · pip package gitpython: upgrade to 3.1.60 or later (affected <= 3.1.59)

[ Advisories ]Government CERT advisories

• BSI CERT-Bund21 Oct 2026WID-SEC-2026-4111

  Red Hat Ansible Automation Platform: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-11332CVE-2026-102938CVE-2026-103262+21 more CVEs
• BSI CERT-Bund23 Sep 2026WID-SEC-2026-3555

  Red Hat Ansible Automation Platform (automation-controller): Multiple vulnerabilities Translated from German

  CVE-2026-84713CVE-2026-71459CVE-2026-84475+58 more CVEs

[ Packages ]Affected open-source packages

• gitpython pipAffected <= 3.1.59 · fixed in 3.1.60 · GHSA-239g-whfq-7xj9

[ References ]References

• github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9vendor-advisory
• www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-dire…third-party-advisory