GHSA-MV93-W799-CJ2W: Remote Code Execution via Config Section Injection in GitPython

Vulnerability ID: GHSA-MV93-W799-CJ2W

CVSS Score: 7.8

Published: 2026-05-08

GitPython versions prior to 3.1.50 are vulnerable to a newline injection attack in the config_writer() and set_value() methods. An incomplete fix for CVE-2026-44244 failed to sanitize the configuration section parameter, allowing an attacker to inject malicious Git configuration blocks such as [core] and override the hooksPath . This leads to unauthenticated remote code execution when subsequent Git operations trigger the injected hooks.

TL;DR

Newline injection in GitPython's config_writer section parameter allows attackers to override core.hooksPath and achieve Remote Code Execution.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-94, CWE-150

Attack Vector : Local (via Application Input)

CVSS Base Score : 7.8 (High)

Exploit Status : Proof of Concept Available

Impact : Remote Code Execution via Git Hooks

Patched Version :…