Executive brief
GitPython is a widely-used Python library for interacting with Git repositories. A flaw in the config_writer() function fails to sanitize newline characters in the section parameter, allowing an attacker to inject arbitrary configuration headers into the .git/config file. By crafting a malicious section name, attackers can inject a fake [core] section pointing to attacker-controlled directories for Git hooks, leading to arbitrary code execution when users run standard Git operations like commits.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) in GitPython's config_writer() method, which passes the section parameter directly to configparser without sanitizing newline characters. While a prior patch (CVE-2026-42215) validated the value parameter, the section and option parameters remain unvalidated. An attacker can inject "\n" sequences into the section argument to write multiple section headers into .git/config; for example, section="user]\n[core" results in both [user] and [core] headers being written. By injecting a malicious [core] section with hooksPath pointing to an attacker-controlled directory, code execution is achieved when any Git hook is triggered. The attack requires local filesystem access and user interaction (triggering a Git hook), but does not require elevated privileges. Patches are available in GitPython 3.1.50 and later.
Affected products
- GitPython GitPython before 3.1.50
Timeline
- 2026-05-06: disclosed
- 2026-05-06: patched: GitPython 3.1.50 and later
- 2026-08-01: advisory