CVE-2026-67326CWE-20

CVE-2026-67326

High · published August 1, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
16.0
In the wild
Unconfirmed
What it is

GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00254 · 16.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-08-01T17:17Z
Affected products (1)
ProductVersionsFixed in
gitpython_project/gitpython< 3.1.503.1.50
References (3)
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w · [email protected]https://www.vulncheck.com/advisories/gitpython-before-newline-injection-via-config-writer-section · [email protected]https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 AUG 12:22Z
    GitPython before 3.1.50 Newline Injection via config_writer section
    cvelistv5