---
id: GHSA-6p8h-3wgx-97gf
title: >-
  GitPython: Incomplete unsafe_git_clone_options denylist omits --template
  enabling arbitrary command execution via clone hooks
summary: >-
  GitPython: Incomplete unsafe_git_clone_options denylist omits --template
  enabling arbitrary command execution via clone hooks
severity: high
cvss: 7.5
cwe:
  - CWE-78
  - CWE-184
vendor: GitPython
product: GitPython
ecosystem: pip
affected:
  - GitPython <= 3.1.53
patched:
  - GitPython 3.1.54
published: '2026-07-24'
updated: '2026-07-24'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-6p8h-3wgx-97gf'
references:
  - url: >-
      https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf
  - url: 'https://github.com/gitpython-developers/GitPython/pull/2180'
  - url: >-
      https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97
  - url: 'https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54'
  - url: 'https://github.com/advisories/GHSA-6p8h-3wgx-97gf'
tags:
  - ghsa
  - pip
ingestedAt: '2026-07-24T17:34:27.973Z'
---

## Overview

## Summary
GitPython's `unsafe_git_clone_options` denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/` into the new repository and runs them (`post-checkout` fires during clone), so a caller who can influence clone options can achieve arbitrary command execution in the default `allow_unsafe_options=False` configuration.

## Root Cause
`base.py:145-152` defines `unsafe_git_clone_options = ["--upload-pack","-u","--config","-c"]` — `--template` is absent. The guard candidate `['--template']` passes `check_unsafe_options` (verified). git copies the hook directory and executes `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL` do not gate `--template`; the incomplete denylist is the only defense.

## Impact
Arbitrary OS command execution during clone (default config). Requires an attacker-readable directory containing an executable hook — a genuine second precondition (realistic via shared filesystems, upload dirs, `/tmp`, or attacker-writable network paths), reflected as AC:H.

## Proof of Concept
```python
# attacker stages <dir>/hooks/post-checkout (chmod +x)
from git import Repo
Repo.clone_from(src, dst, template='<dir>')   # post-checkout hook executes -> marker created (verified)
```

## Attack Chain
1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x). Guard: n/a (filesystem).
2. Entry: `Repo.clone_from(url, path, template='<dir>')`. Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`. Bypass proof: `--template` not on the denylist -> passes (verified candidate `['--template']`, no error).
3. Sink: git copies the hook and executes `post-checkout` at checkout. Impact: ACE, default config (verified marker created).

## Bypass Evidence
Live-verified on HEAD (tag 3.1.53): guard candidate `['--template']` passed with no error; staged `post-checkout` hook executed during `clone_from`, creating the marker. Independent of the value-smuggle bypass (`--template` is a legitimate long option that survives any single-char-value fix). Not covered by any existing advisory.

## Affected Versions
`<= 3.1.53`

## Suggested Fix
Add `--template` (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.

---
Reported by **zx (Jace)** — GitHub: @manus-use

## Affected packages

- `GitPython <= 3.1.53`

## Remediation

Upgrade to a patched release:

- `GitPython 3.1.54`