EUVD-2026-51814
GHSA-gmvg-8p66-77hg
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector since attacker must influence library-level input; AC:H and UI:R because a hook-triggering git operation must follow; PR:N as no system authentication is required.
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4Blast Radius
ecosystem impact- 55 pypi packages depend on gitpython (48 direct, 7 indirect)
Ecosystem-wide dependent count for version 3.1.50.
DescriptionCVE.org
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.
AnalysisAI
Remote code execution via newline injection in GitPython before 3.1.50 allows an attacker who controls the section argument of config_writer().set_value() to forge arbitrary section headers - including a malicious [core] block - in .git/config, redirecting git hook execution to an attacker-controlled directory. This is a confirmed incomplete-patch bypass of CVE-2026-42215: the 3.1.49 fix sanitized only the value parameter while leaving section and option unvalidated. A working proof-of-concept is publicly available in the vendor's GHSA advisory, and the fix is confirmed in GitPython 3.1.50.
Technical ContextAI
GitPython (CPE: cpe:2.3:a:gitpython-developers:gitpython:*:*:*:*:*:*:*:*) is a widely used Python library for programmatic git repository interaction. The vulnerability originates in git/config.py: set_value() calls add_section() with the caller-supplied section string without any newline validation, then passes it to Python's configparser. The _write() method formats section headers as '[%s]\n' - so a section argument of 'user]\n[core' produces two syntactically valid section headers in .git/config. This allows injection of a forged [core] section specifying hooksPath to an attacker-controlled directory. CWE-20 (Improper Input Validation) is the root cause - specifically an incomplete fix that left two of three parameters (section and option) unsanitized after the prior CVE-2026-42215 patch addressed only the value parameter.
RemediationAI
Upgrade GitPython to version 3.1.50 or later via pip (pip install --upgrade gitpython), which introduces newline validation for the section parameter in config_writer() and closes this bypass. The vendor advisory is at https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w. If immediate upgrade is not feasible, audit all callers of config_writer().set_value() in your codebase and reject or sanitize any externally-influenced section arguments at the application layer - note this requires code-level review of every call site and is error-prone. As a secondary compensating control, set core.hooksPath to /dev/null in affected repositories (git config core.hooksPath /dev/null) to prevent hook execution, though this will break any hook-dependent CI or automation workflows. Do not rely on the 3.1.49 patch as sufficient mitigation - it is confirmed incomplete for section and option parameters.
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
Command injection in GitPython 3.1.30-3.1.46 allows remote authenticated attackers to execute arbitrary commands via und
Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using
Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
Same weakness CWE-20 – Improper Input Validation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | Affected |
| SUSE Linux Enterprise Module for Python 3 15 SP4 | Affected |
| SUSE Linux Enterprise Module for Python 3 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP4 | Affected |
| SUSE Linux Enterprise Server 15 SP4-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP5 | Affected |
| SUSE Linux Enterprise Server 15 SP5-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Manager Proxy 4.3 | Affected |
| SUSE Manager Retail Branch Server 4.3 | Affected |
| SUSE Manager Server 4.3 | Affected |
| SUSE Linux Enterprise Desktop 15 SP4 | Affected |
| SUSE Linux Enterprise Desktop 15 SP5 | Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today