CVE-2026-76221: GitPython before 3.1.58 Config Injection via option-name
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.1.58 - Compensating control
Ensure that untrusted repositories/config files are not used to trigger the vulnerable next Git operation; isolate or avoid running the next GitPython git operation on attacker-controlled inputs until patched.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates low-privileged access is required, while user interaction is not required. Exploitation depends on the attacker being able to supply a malicious Git configuration option name to affected GitPython code.
When does injected configuration become dangerous?
The injected directive can cause arbitrary command execution on a subsequent Git operation. Examples in the advisory include configuring core.sshCommand or core.hooksPath through a forged option name.
Which versions should be remediated?
GitPython versions before 3.1.58 are affected. Upgrade to 3.1.58 or later.