CVE-2026-76218
CVE-2026-76218: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-76218] Remote Code Execution via malicious Git hooks
CVE-2026-76218Source published Source updated
GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository. A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the `Repo.init` function, an attacker can point to a directory containing malicious Git hooks. Red Hat products that bundle GitPython use it as an internal build/automation-time dependency and do not expose the Repo.init template/options parameters to adversary-controlled input; the vulnerable parameter…
- Affected products in this advisory
- Red Hat Satellite 6.19 for RHEL 9
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
1 more entries in the full advisory.
- Source-reported affected versions
- < 3.1.58
- Source-reported fixed versions
- python3.12-gitpython-0:3.1.59-1.el9pc
- ansible-automation-platform-25/controller-rhel8:1789607021
- ansible-automation-platform-26/controller-rhel9:1789673739
- ansible-automation-platform-27/controller-rhel9:1789580684
12 more entries in the full advisory.
- Mitigation guidance
- Do not pass untrusted or attacker-influenced input as the template parameter (or other forwarded options) to GitPython's Repo.init. Upgrade to GitPython 3.1.58 or later, where the unsafe option forwarding is fixed.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.