--- id: CVE-2026-76218 title: >- gitpython: GitPython: Remote Code Execution via malicious Git hooks (CVE-2026-76218) summary: >- A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the `Repo.init` function, an attacker can point to a directory containin… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H' cvssSource: vendor cwe: - CWE-94 - CWE-88 vendor: Red Hat product: Red Hat Ansible Automation Platform 2 affected: - ansible_automation_platform 2 - satellite 6 - satellite_6_19_for_rhel 9 - satellite 6.18 - satellite 6.19 patched: - satellite_6_19_for_rhel 9 - satellite 6.18 - satellite 6.19 published: '2026-08-19' updated: '2026-09-21' sourceUpdated: '2026-09-21T10:27:34+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76218.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76218.json - url: 'https://access.redhat.com/security/cve/CVE-2026-76218' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2519603' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-76218' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76218' - url: >- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r - url: >- https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init - url: 'https://access.redhat.com/errata/RHSA-2026:63385' - url: 'https://access.redhat.com/errata/RHSA-2026:68764' - url: 'https://access.redhat.com/errata/RHSA-2026:68771' - url: 'https://access.redhat.com/errata/RHSA-2026:68780' - url: 'https://access.redhat.com/errata/RHSA-2026:68776' - url: 'https://github.com/gitpython-developers/GitPython/pull/2204' - url: 'https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66' - url: 'https://github.com/gitpython-developers/GitPython' - url: 'https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58' - url: 'https://pypi.org/project/gitpython' - url: 'https://github.com/advisories/GHSA-9rj7-rf2p-w77r' tags: - csaf - vex - red-hat - osv - pip - ghsa epss: 0.0072 epssPercentile: 0.52029 aliases: - GHSA-9rj7-rf2p-w77r - PYSEC-2026-3840 ecosystem: pip ingestedAt: '2026-08-20T19:23:05.654Z' --- ## Overview A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the `Repo.init` function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on the initialized repository, these hooks execute arbitrary code, leading to a complete compromise of the affected system. ## Vendor advisories - **RHSA-2026:63385** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63385) - **RHSA-2026:68764** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68764) - **RHSA-2026:68771** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68771) - **RHSA-2026:68780** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68780) - **RHSA-2026:68776** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68776) - **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Satellite 6 · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Satellite 6 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76218.json) **gitpython: GitPython: Remote Code Execution via malicious Git hooks** — rated Important by Red Hat. Released 2026-08-19, updated 2026-09-21. Affected: - Red Hat Ansible Automation Platform 2 - Red Hat Satellite 6 Fixed: - Red Hat Satellite 6.19 for RHEL 9 - Red Hat Satellite 6.18 - Red Hat Satellite 6.19 No fix planned: - Red Hat Ansible Automation Platform 2 - Red Hat Satellite 6 Not affected: - Red Hat Satellite 6.19 for RHEL 9 - Exploit Intelligence - Migration Toolkit for Applications 8 - Pen Drive Powered by Red Hat Lightspeed - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat Hardened Images - Red Hat OpenShift AI (RHOAI) - Red Hat OpenStack Platform 16.2 ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:63385 For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. https://access.redhat.com/errata/RHSA-2026:68764 For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. https://access.redhat.com/errata/RHSA-2026:68771 Workarounds / mitigations: - Do not pass untrusted or attacker-influenced input as the template parameter (or other forwarded options) to GitPython's Repo.init. Upgrade to GitPython 3.1.58 or later, where the unsafe option forwarding is fixed. ## Package advisory (CVE-2026-76218) Affected packages: - `gitpython < 3.1.58` Patched in: - `gitpython 3.1.58` Source: https://osv.dev/vulnerability/GHSA-9rj7-rf2p-w77r