{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-76220/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-76218"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitPython"],"_cs_severities":["high"],"_cs_tags":["vulnerability","argument-injection","gitpython","cve-2026-76219","cve-2026-76220","rce"],"_cs_type":"advisory","_cs_vendors":["gitpython-developers"],"content_html":"\u003cp\u003eGitPython versions before 3.1.58 contain a remote code execution (RCE) vulnerability within the \u003ccode\u003eRepo.init\u003c/code\u003e method. The flaw is categorized as an argument injection vulnerability (CWE-88), where the library fails to properly neutralize arguments passed to the underlying Git command. An attacker can provide a \u003ccode\u003etemplate\u003c/code\u003e parameter that points to a user-controlled directory containing malicious git hooks. When the application or user performs subsequent git operations on the initialized repository, the attacker-provided hooks are executed with the privileges of the process running the GitPython library. This vulnerability poses a high risk to applications that expose repository initialization functionality to untrusted inputs or users.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the host machine running the affected application. This vulnerability is applicable to any environment using GitPython for repository automation or management where user input influences the \u003ccode\u003eRepo.init\u003c/code\u003e parameters. Given that GitPython is widely integrated into CI/CD pipelines, automation scripts, and developer tools, the impact could range from complete system compromise to lateral movement within a development environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eGitPython\u003c/code\u003e package to version 3.1.58 or later immediately to incorporate the necessary input validation for the \u003ccode\u003eRepo.init\u003c/code\u003e method.\u003c/li\u003e\n\u003cli\u003eAudit existing implementations that utilize \u003ccode\u003eRepo.init\u003c/code\u003e to ensure that the \u003ccode\u003etemplate\u003c/code\u003e parameter is not sourced from untrusted or user-supplied input.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or allowlisting for any parameters passed to \u003ccode\u003egit\u003c/code\u003e related operations if the application architecture prevents immediate library updates.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T14:34:54Z","date_published":"2026-08-19T14:34:37Z","id":"https://feed.craftedsignal.io/briefs/2026-08-gitpython-rce/","summary":"GitPython versions before 3.1.58 are vulnerable to RCE via improper validation of arguments in the Repo.init method, allowing attackers to inject malicious git hooks.","title":"Remote Code Execution in GitPython via Repo.init","url":"https://feed.craftedsignal.io/briefs/2026-08-gitpython-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-76220","version":"https://jsonfeed.org/version/1.1"}