CVE-2026-78677

GitPython's clone-path safety check is incomplete: the denylist `Repo.unsafe_git_clone_options` used by `Repo.clone_from()` and `Repo.clone()` omits `--separate-git-dir`, even though GitPython's own documentation for these APIs states that `allow_unsafe_options=False` (the default) should block that option, and the sibling denylist for `Repo.init()` already blocks it for the same reason. Any application that forwards a caller-controlled `separate_git_dir`/`separate-git-dir` keyword argument into these clone APIs therefore bypasses the check entirely, causing `git clone` to redirect the repository's `.git` metadata directory to an arbitrary, attacker-chosen filesystem path while leaving only a gitlink text file at the intended destination. An attacker gains control over where git metadata (and the git directory itself) is written outside the target path — a path-control primitive that CVSS 4.0 scores as 8.7 High (network vector, no privileges or user interaction, High confidentiality impact, no integrity or availability impact). Affected users are pip-installation environments running GitPython (current release 3.1.58 at disclosure), particularly CI/build services, Git-hosting proxies, and tools that expose clone options to clients — the same threat model already accepted for the `--template`, `--upload-pack`, and `--config` entries in this list. There is no known exploitation: no public PoC, not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.4% (36th percentile); this is the latest in a series of roughly 16 published advisories since 2026-07-12 finding this same denylist mechanism incomplete.

What to do: Upgrade GitPython to a release newer than 3.1.58 once a fix is published, since remediation requires extending `unsafe_git_clone_options`; as an interim mitigation, audit any code that passes user- or caller-controlled keyword arguments to `Repo.clone_from()`/`Repo.clone()` and strip or reject `separate_git_dir`/`separate-git-dir` (and other clone options) from untrusted input. Note that setting `allow_unsafe_options=True` disables GitPython's option checks entirely, so if you use it, validate all forwarded clone options yourself.