CVE-2026-87817Patch(gitpython_project / gitpython)

🚨High - GitPython Git Directory Impersonation Code Execution (CVE-2026-87817) GitPython versions before 3.1.60 fail to properly validate that a repository's git directory is legitimate, trusting tracked metadata files like gitdir, commondir, and HEAD without verification. This lets an attacker craft a repository that impersonates its own git directory. By planting a malicious pre-commit hook inside the tracked hooks directory, the attacker gets it to execute the moment a victim calls index.commit() on the cloned or opened repository - turning a routine commit operation into arbitrary code execution. Any application, CI pipeline, or script that uses GitPython to clone or open repositories from untrusted sources is exposed. 👉Upgrade to GitPython 3.1.60.