The flaw occurs in GitPython’s processing of clone options. The library validates a list of options before converting it into a string and splitting it, allowing a malicious string such as "--branch main --config core.hooksPath=/x" to pass validation. The subsequent split produces separate tokens that Git interprets as configuration changes, effectively pointing hooks to an attacker-specified directory. When the repository is cloned, Git automatically installs and runs hooks from that directory, thereby executing arbitrary code. This is a classic example of inadequate input validation (CWE‑88) that can lead to remote code execution on the machine running the clone operation.

Systems using the GitPython library in any Python application are affected. The vulnerability exists in all releases prior to 3.1.47. An affected system will run Python code that invokes GitPython _clone() with the option vector passed from untrusted sources, such as user input or external repository protocols.

The CVSS score of 8.1 indicates high severity. EPSS data is not available, and the vulnerability is not yet listed as a known exploit in the CISA KEV catalog. Attackers with the ability to supply or influence repository URLs that are cloned by the application can exploit this flaw. The vulnerability does not require elevated privileges, so it remains a strong local or remote threat to any application that performs unrestricted clone operations.