{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/gitpython--3.1.53/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitPython \u003c= 3.1.53"],"_cs_severities":["high"],"_cs_tags":["git","python","vulnerability","rce"],"_cs_type":"advisory","_cs_vendors":["GitPython"],"content_html":"\u003cp\u003eA high-severity vulnerability exists in GitPython versions up to and including 3.1.53, stemming from an incomplete denylist within the \u003ccode\u003eunsafe_git_clone_options\u003c/code\u003e mechanism. Specifically, the \u003ccode\u003e--template\u003c/code\u003e option for \u003ccode\u003egit clone\u003c/code\u003e is not blocked, allowing an attacker to specify a path to an attacker-controlled directory containing malicious Git hooks. When GitPython executes the underlying \u003ccode\u003egit clone\u003c/code\u003e command, these hooks, such as \u003ccode\u003epost-checkout\u003c/code\u003e, are copied into the new repository and subsequently executed during the checkout phase. This oversight leads to arbitrary command execution on the system hosting the GitPython application. The exploitation requires the attacker to provide an attacker-readable directory containing an executable hook, which can be realistic via shared filesystems, upload directories, or attacker-writable network paths. This flaw impacts all platforms where GitPython is used.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious Git hook script (e.g., \u003ccode\u003epost-checkout\u003c/code\u003e) containing commands designed for arbitrary execution on the victim's system.\u003c/li\u003e\n\u003cli\u003eAttacker places this malicious script into a specially structured directory, such as \u003ccode\u003e\u0026lt;attacker_controlled_path\u0026gt;/hooks/post-checkout\u003c/code\u003e, ensuring it has executable permissions.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a vulnerable GitPython application that performs \u003ccode\u003eRepo.clone_from\u003c/code\u003e operations and can be manipulated to accept an attacker-controlled value for the \u003ccode\u003etemplate\u003c/code\u003e argument.\u003c/li\u003e\n\u003cli\u003eThe vulnerable GitPython application is tricked into initiating a \u003ccode\u003eRepo.clone_from\u003c/code\u003e call, passing the attacker-controlled path to the \u003ccode\u003etemplate\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eGitPython's internal \u003ccode\u003echeck_unsafe_options\u003c/code\u003e function, intended to prevent dangerous \u003ccode\u003egit clone\u003c/code\u003e options, fails to block \u003ccode\u003e--template\u003c/code\u003e because it is missing from its \u003ccode\u003eunsafe_git_clone_options\u003c/code\u003e denylist.\u003c/li\u003e\n\u003cli\u003eThe underlying \u003ccode\u003egit\u003c/code\u003e command is executed on the host system, including the \u003ccode\u003e--template=\u0026lt;attacker_controlled_path\u0026gt;\u003c/code\u003e option.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egit\u003c/code\u003e command copies the malicious \u003ccode\u003epost-checkout\u003c/code\u003e hook from \u003ccode\u003e\u0026lt;attacker_controlled_path\u0026gt;/hooks/\u003c/code\u003e to the newly cloned repository's \u003ccode\u003e.git/hooks/\u003c/code\u003e directory.\u003c/li\u003e\n\u003cli\u003eDuring the repository checkout process, which is part of the \u003ccode\u003egit clone\u003c/code\u003e operation, the newly copied malicious \u003ccode\u003epost-checkout\u003c/code\u003e hook is automatically executed, resulting in arbitrary command execution on the victim's system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to arbitrary operating system command execution on the host running the GitPython application. An attacker could leverage this to install malware, exfiltrate sensitive data, establish persistence, or further compromise the affected system and network. While a second precondition of an attacker-readable directory with an executable hook is necessary, this is considered achievable in many real-world scenarios. This vulnerability affects any system using vulnerable versions of GitPython, regardless of the underlying operating system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade GitPython to a patched version once available.\u003c/li\u003e\n\u003cli\u003eImplement host-based detection for unusual Git command-line parameters, specifically the \u003ccode\u003e--template\u003c/code\u003e option, by deploying the Sigma rule provided in this brief.\u003c/li\u003e\n\u003cli\u003eMonitor process creation logs for \u003ccode\u003egit.exe\u003c/code\u003e or \u003ccode\u003egit\u003c/code\u003e processes executing with unusual arguments or child processes that deviate from expected behavior for Git operations.\u003c/li\u003e\n\u003cli\u003eRestrict write permissions on directories that could be used by attackers to stage malicious Git hooks, such as temporary directories or shared network drives.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T16:45:20Z","date_published":"2026-07-24T16:45:20Z","id":"https://feed.craftedsignal.io/briefs/2026-07-gitpython-unsafe-git-clone-options/","summary":"A critical vulnerability in GitPython versions up to 3.1.53 allows attackers to achieve arbitrary command execution by influencing `git clone` options to include a malicious `--template` directory, which causes Git hooks to be copied and executed during cloning, even in default configurations.","title":"GitPython Incomplete Denylist Allows Arbitrary Command Execution via Git Clone Hooks","url":"https://feed.craftedsignal.io/briefs/2026-07-gitpython-unsafe-git-clone-options/"}],"language":"en","title":"CraftedSignal Threat Feed - GitPython \u003c= 3.1.53","version":"https://jsonfeed.org/version/1.1"}