Zero Radar
← feed
HighVulnerabilityGHSA-23mf-xhv8-69c2updated 27 Oct 2026, 15:29 UTC

GitPython: cloning a malicious repo can leak local files

If an app uses GitPython to clone a repository from a URL an attacker controls, the attacker can trick it into showing the contents of a file on the app's server, such as system user lists. No login is needed by the attacker.

Fixed in GitPython 3.2.0Official source
SeverityHighCVSS 7.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesGitPython 3.2.0 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker publishes repoDefault branch named as a git option
  2. 2App clones the URLConsumer runs a normal clone
  3. 3Checkout runs unguardedBranch name reaches git without '--'
  4. 4Git reads local fileOption treats path as input file
  5. 5Contents echoed backFile text appears in error message
  6. ResultAttacker reads server files

What happened

Head.checkout() passes the branch name to git checkout without a '--' separator, so a branch named like a git option (--pathspec-from-file=/etc/passwd) is interpreted as an option and file contents are returned in the error message.

Why it is dangerous: Any service that clones user-supplied repository URLs (CI systems, importers, scanners, bots) can have files readable by its process exposed to whoever supplies the URL. The vulnerable code is a standard clone-then-checkout pattern with default settings.

Are you affected?

You are affected if you use GitPython 3.1.62 or earlier and your application clones repositories from URLs that users or outsiders can supply, then checks out the default branch.

Package / productAffected versionsFixed in
GitPython · pip<= 3.1.623.2.0

What to do

  1. Update GitPython to 3.2.0 or later (pip install --upgrade 'GitPython>=3.2.0')
  2. If you cannot upgrade yet, do not clone or check out untrusted repository URLs, or run the clone in a sandbox with no sensitive files readable
  3. Review logs for clones of unfamiliar repositories whose branch names start with '--'

Timeline

  1. 27 Oct 2026, 15:28 UTC
    Publicly disclosed
  2. 27 Oct 2026, 15:28 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 15:29 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-23mf-xhv8-69c2
CVSS
7.1 / 10
Disclosed
27 Oct 2026, 15:28 UTC
On Zero Radar
27 Oct 2026, 15:29 UTC (1 min after disclosure)
Last change
27 Oct 2026, 15:29 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

GitPython: cloning a malicious repo can leak local files · Zero Radar