CVE-2026-78676: GitPython before 3.1.59 Remote Code Execution via Config Injection
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.1.59 - Compensating control
Ensure GitPython configuration files cannot be modified by untrusted users prior to GitPython config write operations, to prevent injected directives from being created and later invoked via git hooks (e.g., restrict filesystem permissions/ownership for git config locations and hook paths).
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Applications using GitPython before 3.1.59 are exposed if they read an attacker-crafted Git configuration and later perform any GitPython configuration write. The write can be unrelated to the malicious value.
What does an attacker need to do?
An attacker needs to supply or cause the use of a Git config containing a multi-line quoted value with embedded newlines. When GitPython re-serializes that value during a config write, the injected content can become an active directive such as core.hooksPath.
How can this lead to code execution?
The injected core.hooksPath directive can redirect Git to attacker-controlled hooks. Code execution occurs when Git invokes a hook from that configured path.
What is the available remediation?
Upgrade GitPython to version 3.1.59 or later. The issue affects versions before 3.1.59.