CVE-2026-78676
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| gitpython-developers | GitPython | 0 < 3.1.59 | affected |
| gitpython-developers | GitPython | 3.1.59 | unaffected |
Weaknesses
- CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
References
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w
- https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.