supply chain · Wed 30 Sep 2026 · 23:27 UTC
GHSA-239g-whfq-7xj9: GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
Filed UTCSource GTH ↗
Repo.__init__ decides which directory is the git directory by testing candidate paths in an order that considers the real .git last. Two earlier tests can be satisfied by ordinary tracked files. Git reserves only the literal name .git, so HEAD, objects/, refs/, config, gitdir, commondir and hooks/ at a repository root are all legal tracked content. Consequently, after a victim opens or clones an attacker's repository, GitPython resolves git_dir to the working-tree root while real git correctly resolves /.git. …
Signals
as the pipeline stamped them- High
- High-risk vulnerability — CVSS 8.8
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-87817 | — | 0.40% | NVD ↗ |
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.