HIGHVulnerability

CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.

Properties

severity
HIGH
score
8.8
cve_id
CVE-2026-87817
signal_observed_at
2026-09-17T21:32:24+00:00
vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
published_at
2026-09-09T12:17:16.830
last_modified
2026-09-16T15:24:41.533

Related Entities (3)

HAS_WEAKNESS (1)

[Weakness]Improper Control of Generation of Code ('Code Injection')

DESCRIBED_BY (1)

[Source]NVD

AFFECTS_PRODUCT (1)

[Product]

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-87817 — Ninja Signal Threat Intelligence | Ninja Signal