PT-2026-67306
CVE-2026-67326
·
Published
2026-05-08
·
Updated
2026-09-18
Description by
CVSS 4.0
9.3
CriticalMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
GitPython versions prior to 3.1.50
Description
GitPython fails to validate newline characters in the section parameter of the
config writer() function. This allows an attacker to inject arbitrary section headers into the .git/config file. By injecting newlines, an attacker can create a forged [core] section and modify the hooksPath variable to point to a directory under their control. This can lead to remote code execution when git hooks are triggered.Recommendations
Update GitPython to version 3.1.50 or later.
As a temporary workaround, restrict user-controlled input from being passed to the section parameter of the
config writer() function.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾