Executive brief
GitPython is a popular Python library used by developers and automation tools to interact with Git repositories. A security flaw allows an attacker to inject malicious configuration settings into a repository's setup file if the application using the library doesn't properly check user-provided information like names or emails. This could allow an attacker to gain full control over the system by forcing Git to run unauthorized scripts whenever common actions like committing or merging code occur.
Technical details
A newline injection vulnerability exists in GitPython's GitConfigParser.set_value() method. The root cause is a failure to validate or sanitize input for newline characters before passing them to the underlying configuration writer. While GitPython attempts to indent newlines into continuation lines, Git's configuration parser still recognizes these indented stanzas as valid section headers. An attacker with the ability to provide input to set_value() (such as through unsanitized author names or emails in a web application) can inject a '[core]' section with a 'hooksPath' directive. This redirects Git hooks to an attacker-controlled directory, leading to arbitrary code execution whenever a Git operation (e.g., commit, merge, checkout) is performed. The issue is fixed in version 3.1.49 by rejecting control characters in configuration values.
Affected products
- gitpython-developers GitPython <= 3.1.48
Timeline
- 2026-04-29: advisory: GitHub Security Advisory published
- 2026-04-30: patched: Version 3.1.49 released
- 2026-05-07: disclosed: CVE-2026-44244 published to NVD