CVE-2026-78677: GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
- CWE: CWE-73 (External Control of File Name or Path) / CWE-22 (Path Traversal, in the “escapes intended base directory” sense)
- Affected component:
git/repo/base.py,Repo.unsafe_git_clone_options(class attribute, lines 153-165) andRepo._clone()(lines 1477-1520), reached via the publicRepo.clone_from()(line 1626) andRepo.clone()(line 1567) APIs. - Affected version: GitPython at HEAD (
9729ed3b948f2bde09f1f188c5311e172212b67e, 2026-08-05, VERSION3.1.58)
References
- github.com/advisories/GHSA-8mcc-hrx5-hvxc
- github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d
- github.com/gitpython-developers/GitPython/pull/2210
- github.com/gitpython-developers/GitPython/releases/tag/3.1.59
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc
- github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3787.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-78677
- www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir
Code Behaviors & Features
Detect and mitigate CVE-2026-78677 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →