CVE-2026-76221: GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

CVE-2026-76221 · Severity: high · CVSS 8.8 · Published 2026-08-19

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.

Technologies: Gitpython Project Gitpython, gitpython (PyPI). Vendors: Gitpython Project, PyPI.

Quick answers

Is CVE-2026-76221 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76221 being exploited in the wild.
How severe is CVE-2026-76221?
High severity, with a CVSS score of 8.8, published 19 August 2026.
Which products and versions are affected?
gitpython (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.58.
Is there a fix for CVE-2026-76221?
Yes. gitpython (PyPI): upgrade to 3.1.58 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-76221?
Check whether you run Gitpython Project Gitpython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • gitpython (PyPI): upgrade to 3.1.58 or later
    pip install "gitpython>=3.1.58"

Affected products

  • Gitpython Project Gitpython
  • gitpython (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.58

Identifiers

  • CVE-2026-76221
  • GHSA-jm78-9fvv-mhgr
  • PYSEC-2026-3783

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.