CVE-2026-78676

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59

Description GitPython fails to safely re-serialize multi-line git-config values during write operations. This allows attackers to craft configuration files containing embedded newlines that can be corrupted into injected directives, such as core.hooksPath. When any unrelated configuration write occurs, these dormant quoted values become active git directives, which can lead to arbitrary code execution through hook invocation.

Recommendations Update GitPython to version 3.1.59 or later.