GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary

Published September 8, 2026 CVE-2026-78677

GitPython: clonefrom()/clone() omit --separate-git-dir from unsafegitcloneoptions, enabling arbitrary git-directory creation outside the destination. CWE: CWE-73 (External Control of File Name or Path) / CWE-22 (Path Traversal, in the "escapes intended base directory" sense) Affected component: git/repo/base.py, Repo.unsafegitcloneoptions (class attribute, lines 153-165) and Repo.clone() (lines 1477-1520), reached via the public Repo.clonefrom() (line 1626) and Repo.clone() (line 1567) APIs.

Severity
HighCVSS 3.1 · 7.5
Fix
Fixed in 3.1.59
Affected versions
before 3.1.59
Weakness
CWE-22Path Traversal
Exploit likelihood
0.43% in 30 daysEPSS, higher than 36% of known flaws
Affects
GitPython

What to do

Update to 3.1.59 or later.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source