THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-9rj7-rf2p-w77r (high) — GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

[GHSA] GHSA-9rj7-rf2p-w77r (high) — GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

medgithub_advisoriesPublished 2026-08-07

GHSA-9rj7-rf2p-w77r Severity: high CVE: None

GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

## Summary `Repo.init()` forwards `**kwargs` verbatim to `git init` with no unsafe-option guard and no `allow_unsafe_options` parameter. `git init --template=<dir>` copies `<dir>/hooks/*` into the new repo's `.git/hooks`, so an attack

Original source: https://github.com/advisories/GHSA-9rj7-rf2p-w77r