THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-8mcc-hrx5-hvxc (high) — GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

[GHSA] GHSA-8mcc-hrx5-hvxc (high) — GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

highgithub_advisoriesPublished 2026-09-08

GHSA-8mcc-hrx5-hvxc Severity: high CVE: CVE-2026-78677

GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

- **CWE:** CWE-73 (External Control of File Name or Path) / CWE-22 (Path Traversal, in the "escapes intended base directory" sense) - **Affected component:** `git/repo/base.py`, `Repo.unsafe

Indicators of compromise

9729ed3b948f2bde09f1f188c5311e172212b67esha1
CVE-2026-78677cve

Original source: https://github.com/advisories/GHSA-8mcc-hrx5-hvxc