GHSA-298h-jpq4-m665

Duplicate Advisory: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

Published

2026-08-19

Modified

2026-09-08

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9rj7-rf2p-w77r. This link is maintained to preserve external references. ## Original Description GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-298h-jpq4-m665