CVE-2026-87817
🟠 Łataj w tym tygodniu
Błąd w GitPython umożliwia zdalne wykonanie kodu przez złośliwe haki pre-commit.
CVSS
8.8
EPSS
0.3%
Exploit
poc
Vendor
gitpython_project
Opis źródłowy (NVD)
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.
exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 8.8 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.3% |
| Opublikowano (NVD) | 2026-09-09 12:17:16 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-16 15:24:41 UTC |
Referencje
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9 ([email protected]) [Exploit, Mitigation, Vendor Advisory]
- https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation ([email protected]) [Third Party Advisory]