The vulnerability is a Remote Code Execution flaw in the Repo.init function of GitPython releases before 3.1.58. The function forwards git options without validation, allowing an attacker to supply a template parameter that points to a directory containing malicious git hooks. When normal git operations are later performed on the initialized repository, those hooks run, executing arbitrary code with the privileges of the process that invoked the git command. This compromise can lead to total compromise of the host system.

This issue affects all versions of the GitPython library distributed by the gitpython-developers before 3.1.58. The library is commonly embedded in Python applications that interact with Git repositories. Any deployment that relies on GitPython for repository initialization and uses untrusted input for the template parameter is potentially vulnerable. Projects that target 3.1.58 or newer are not affected.

The CVSS score of 7.7 indicates a high severity level. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, so the current understanding of exploitation likelihood is limited. The attack requires the ability to control the template parameter supplied to Repo.init, which typically means the attacker can influence code that runs within the affected application. Once a malicious template with hooks is provided, the hooks are executed during subsequent git commands, giving the attacker full execution rights on the host. Since the flaw is in a library, an attacker could potentially execute arbitrary code remotely by delivering a specially crafted repository or by affecting privileged code that calls Repo.init. The lack of immediate detection means the vulnerability can remain undiscovered until an exploit is used.