EUVD-2026-65222
GHSA-9557-234j-7rv9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious config can arrive over the network (AV:N) with no auth (PR:N), but requires a dormant value plus a later unrelated config write and a hook-invoking op, so AC:H; full RCE gives C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
AnalysisAI
Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config values: a dormant crafted value is silently rewritten into a live directive such as core.hooksPath whenever GitPython performs any unrelated config write. An attacker who can seed a malicious config value can thereby point hook execution at attacker-controlled code, gaining code execution the next time a hook-invoking git operation runs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a git configuration processed by GitPython already contains an attacker-influenced multi-line quoted value (for example via a malicious cloned repository's config or a shared/included config the attacker can write to), AND that the vulnerable application subsequently performs any GitPython config write, triggering the unsafe re-serialization that promotes the dormant value into a real directive such as core.hooksPath; a hook-invoking git operation must then run for code to execute. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and should be read carefully rather than taken at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a repository whose .git/config (or an included config) carries a specially crafted multi-line quoted value that is inert as-is. A CI pipeline or developer tool using pre-3.1.59 GitPython clones the repo and, in the course of normal automation, performs an unrelated config write; the round-trip rewrite converts the dormant value into a live core.hooksPath directive, and the next git operation invokes the attacker's hook script, executing code on the runner. … |
| Remediation | Vendor-released patch: upgrade GitPython to 3.1.59 or later, which corrects the unsafe re-serialization of multi-line quoted config values; this is the primary and recommended fix, per advisory GHSA-284h-m62q-gf8w (https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all systems and applications running GitPython to determine deployed versions and identify which environments are affected-prioritizing production, CI/CD pipelines, and systems processing untrusted repositories. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using
Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution vi
Environment variable exfiltration in GitPython before 3.1.52 allows any attacker who controls a URL passed to `Repo.clon
Share
External POC / Exploit Code
Leaving vuln.today