CVE-2026-76221

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58

Description A config-name injection issue exists in the option-name validator. This allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. By using malicious option names such as sshCommand = touch /tmp/RCE #, an attacker can execute arbitrary commands through core.sshCommand or core.hooksPath during the subsequent git operation.

Recommendations Update GitPython to version 3.1.58 or later.