CVE-2026-76221
HighCVSS 8.8Summary
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.
Risk Assessment
An attacker can execute arbitrary commands on the victim's machine during git operations, potentially leading to full system compromise.
Recommendation
Upgrade GitPython to version 3.1.58 or later. Be cautious with repositories from untrusted sources.
Original NVD description (English source)
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.