Remote Code Execution in GitPython via Repo.init

GitPython versions before 3.1.58 contain a remote code execution (RCE) vulnerability within the Repo.init method. The flaw is categorized as an argument injection vulnerability (CWE-88), where the library fails to properly neutralize arguments passed to the underlying Git command. An attacker can provide a template parameter that points to a user-controlled directory containing malicious git hooks. When the application or user performs subsequent git operations on the initialized repository, the attacker-provided hooks are executed with the privileges of the process running the GitPython library. This vulnerability poses a high risk to applications that expose repository initialization functionality to untrusted inputs or users.

Impact

Successful exploitation allows for arbitrary code execution on the host machine running the affected application. This vulnerability is applicable to any environment using GitPython for repository automation or management where user input influences the Repo.init parameters. Given that GitPython is widely integrated into CI/CD pipelines, automation scripts, and developer tools, the impact could range from complete system compromise to lateral movement within a development environment.

Recommendation

• Upgrade the GitPython package to version 3.1.58 or later immediately to incorporate the necessary input validation for the Repo.init method.
• Audit existing implementations that utilize Repo.init to ensure that the template parameter is not sourced from untrusted or user-supplied input.
• Implement strict input validation or allowlisting for any parameters passed to git related operations if the application architecture prevents immediate library updates.