---
schema_version: '1.0'
id: security-20260725-96fd04
url: https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf
url_hash: 96fd041e4e3d7367b277a159f4b1706bc0ef209e500f82aad5fafba1f058de77
canonical_url: https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- GHSA-6p8h-3wgx-97gf
- severity:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- gitpython
- PyPI
lang: en
published_at: '2026-07-24T16:42:09Z'
fetched_at: '2026-07-25T07:04:02.183879Z'
updated_at: '2026-07-25T07:04:18Z'
status: published
content_hash: bbcfde99e3ad6db92b65b4e733eb1f0ea7d6348e50b14bb5b887bcee9739ca59
content_changed_at: null
license_note: full
summary: 'GitPython: Incomplete unsafe_git_clone_options denylist omits --template
  enabling arbitrary command execution via clone hooks'
summary_source: rss
summary_en: 'GitPython: Incomplete unsafe_git_clone_options denylist omits --template
  enabling arbitrary command execution via clone hooks'
entities:
- name: GitPython
  type: artifact
- name: Incomplete_Aesthetics
  type: concept
- name: GitHub
  type: organization
key_facts: []
related: []
related_auto:
- name: AI_Ethics
  type: UNKNOWN
  weight: 1.0
- name: Block
  type: organization
  weight: 1.0
- name: ブロック
  type: organization
  weight: 1.0
title: 'GHSA-6p8h-3wgx-97gf: GitPython: Incomplete unsafe_git_clone_options denylist
  omits --template enabling arbitrary command execution via clone hooks'
---

# GHSA-6p8h-3wgx-97gf: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

## TL;DR
GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

## Key Points
- cve / GHSA-6p8h-3wgx-97gf / severity:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H / gitpython / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
**Advisory:** GHSA-6p8h-3wgx-97gf

**Affected (your watchlist):**
- `PyPI:gitpython` 3.1.46 → fixed in 3.1.54 [docker/docker-llmwiki]

**Details:**
## Summary
GitPython's `unsafe_git_clone_options` denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/` into the new repository and runs them (`post-checkout` fires during clone), so a caller who can influence clone options can achieve arbitrary command execution in the default `allow_unsafe_options=False` configuration.

## Root Cause
`base.py:145-152` defines `unsafe_git_clone_options = ["--upload-pack","-u","--config","-c"]` — `--template` is absent. The guard candidate `['--template']` passes `check_unsafe_options` (verified). git copies the hook directory and executes `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL` do not gate `--template`; the incomplete denylist is the only defense.

## Impact
Arbitrary OS command execution during clone (default config). Requires an attacker-readable directory containing an executable hook — a genuine second precondition (realistic via shared filesystems, upload dirs, `/tmp`, or attacker-writable network paths), reflected as AC:H.

## Proof of Concept
```python
# attacker stages <dir>/hooks/post-checkout (chmod +x)
from git import Repo
Repo.clone_from(src, dst, template='<dir>')   # post-checkout hook executes -> marker created (verified)
```

## Attack Chain
1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x). Guard: n/a (filesystem).
2. Entry: `Repo.clone_from(url, path, template='<dir>')`. Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`. Bypass proof: `--template` not on the denylist -> passes (verified candidate `['--template']`, no error).
3. Sink: git copies the hook and executes `post-checkout` at checkout. Impact: ACE, default config (verified marker created).

## Bypass Evidence
Live-verified on HEAD (tag 3.1.53): guard candidate `['--template']` passed with no error; staged `post-checkout` hook executed during `clone_from`, creating the marker. Independent of the value-smuggle bypass (`--template` is a legitimate long option that survives any single-char-value fix). Not covered by any existing advisory.

## Affected Versions
`<= 3.1.53`

## Suggested Fix
Add `--template` (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.

---
Reported by **zx (Jace)** — GitHub: @manus-use

**References:**
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf
- https://github.com/gitpython-developers/GitPython/pull/2180
- https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97
- https://github.com/gitpython-developers/GitPython
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf_

## Source
元記事: [GHSA-6p8h-3wgx-97gf: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf) — published 2026-07-24T16:42:09Z