CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.60 are vulnerable due to improper validation of the git directory location, enabling attackers to impersonate the git directory using tracked files. This flaw allows for the execution of arbitrary code via malicious pre-commit hooks when a victim invokes index.commit() on a compromised repository. Organizations utilizing GitPython should prioritize patching to mitigate the risk of code execution attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.