High [CVE-2026-76218] Remote Code Execution via malicious Git hooks

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.

A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution.

By supplying a specially crafted template parameter to the `Repo.init` function, an attacker can point to a directory containing malicious Git hooks.

Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose the Repo.init template/options parameters to adversary-controlled input; the vulnerable parameter cannot be controlled by an attacker in these products, so they are marked not affected.

GitPython as shipped in Red Hat OpenStack Platform 16.2 and 17.1 contains the vulnerable library code and retains its affected determination. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Weakness: CWE-94.

Affected products named by the advisory: Red Hat Satellite 6.19 for RHEL 9; Red Hat Ansible Automation Platform 2.5; Red Hat Ansible Automation Platform 2.6; Red Hat Ansible Automation Platform 2.7; and 1 more.