Skip to main content

GitPython EUVDEUVD-2026-51814

| CVE-2026-67326 HIGH
Improper Input Validation (CWE-20)
2026-08-01 VulnCheck GHSA-gmvg-8p66-77hg
RCE Gitpython
7.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.3 HIGH
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.0 HIGH

Local vector since attacker must influence library-level input; AC:H and UI:R because a hook-triggering git operation must follow; PR:N as no system authentication is required.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 01, 2026 - 13:20 vuln.today
Analysis Generated
Aug 01, 2026 - 13:20 vuln.today
Patch available
Aug 01, 2026 - 13:01 EUVD
CVE Published
Aug 01, 2026 - 12:22 cve.org
HIGH 7.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 61 pypi packages depend on gitpython (47 direct, 14 indirect)

Ecosystem-wide dependent count for version 3.1.50.

DescriptionCVE.org

GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.

AnalysisAI

Remote code execution via newline injection in GitPython before 3.1.50 allows an attacker who controls the section argument of config_writer().set_value() to forge arbitrary section headers - including a malicious [core] block - in .git/config, redirecting git hook execution to an attacker-controlled directory. This is a confirmed incomplete-patch bypass of CVE-2026-42215: the 3.1.49 fix sanitized only the value parameter while leaving section and option unvalidated. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Control application input reaching config_writer()
Delivery
Inject newline into section parameter
Exploit
Forge [core] section in .git/config
Execution
Set hooksPath to attacker-controlled directory
Persist
Trigger git hook via commit or push
Impact
Execute arbitrary code as git process user
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an attacker to control or meaningfully influence the section argument passed to config_writer().set_value() within a GitPython-based application - this is the critical and non-trivial prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H) reflects a local attack with high complexity and attack prerequisites - exploitation is conditional on controlling input to the section parameter AND subsequently triggering a git hook operation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with the ability to influence a Python application's input that reaches config_writer().set_value() crafts a section string such as 'user]\n[core' paired with a hooksPath value pointing to an attacker-controlled directory containing a malicious pre-commit script. When a developer or automated pipeline subsequently runs a git commit or any hook-triggering operation in the affected repository, git reads the forged [core] hooksPath from .git/config and executes the attacker's script with the privileges of the git process. …
Remediation Upgrade GitPython to version 3.1.50 or later via pip (pip install --upgrade gitpython), which introduces newline validation for the section parameter in config_writer() and closes this bypass. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: scan infrastructure and applications to identify all systems running GitPython versions prior to 3.1.50, with priority flagging for CI/CD agents, version control integrations, and deployment automation. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Gitpython

View all
CVE-2022-24439 CRITICAL POC
9.8 Dec 06

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
CVE-2023-40590 HIGH POC
7.8 Aug 28

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-41040 MEDIUM POC
6.5 Aug 30

GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
CVE-2023-40267 CRITICAL
9.8 Aug 11

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
CVE-2026-67324 CRITICAL
9.3 Aug 01

Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
CVE-2026-67325 HIGH
8.7 Aug 01

Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
CVE-2026-67323 HIGH
8.6 Aug 01

Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
CVE-2026-67322 HIGH
8.7 Aug 01

Environment variable exfiltration in GitPython before 3.1.52 allows any attacker who controls a URL passed to `Repo.clon
CVE-2026-69097 HIGH
7.3 Aug 03

Git-config section-name injection in GitPython <= 3.1.52 enables remote code execution by writing attacker-controlled `c
CVE-2024-22190 HIGH POC
7.8 Jan 11

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

EUVD-2026-51814 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy