GitPython RCE via git-config option name injection

Executive brief

GitPython is a Python library used to interact with Git repositories. A vulnerability in how it handles configuration settings allows an attacker to inject malicious commands into the Git configuration file. If an application using GitPython allows user-controlled input to reach the configuration writer, an attacker can execute arbitrary code on the system during subsequent Git operations.

Technical details

A vulnerability exists in GitPython's config-name validator within `git/config.py`. The `_assure_config_name_safe` function fails to properly sanitize the 'option' label, only checking for CR/LF/NUL characters while allowing '=', '#', ';', '[', ']', and whitespace. An attacker can provide a crafted option name that, when written to the `.git/config` file via `write_section`, injects new configuration directives such as `core.sshCommand` or `core.hooksPath`. This leads to Remote Code Execution (RCE) when the repository is subsequently used for Git operations. The issue is fixed in version 3.1.58.

Affected products

• gitpython-developers GitPython <= 3.1.57

Timeline

• 2026-08-04: disclosed
• 2026-08-07: advisory
• 2026-08-07: patched: Fixed in version 3.1.58

References

• https://api.github.com/users/manus-use
• https://github.com/manus-use
• https://api.github.com/users/manus-use/gists%7B/gist_id%7D
• https://api.github.com/users/manus-use/repos
• https://avatars.githubusercontent.com/u/213290975?v=4
• https://api.github.com/users/manus-use/events%7B/privacy%7D