CVE-2026-78676
CriticalCVSS 9.8Summary
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, potentially turning dormant quoted values into active directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live after any GitPython config write, enabling arbitrary code execution.
Risk Assessment
This can lead to arbitrary code execution in the context of the application using GitPython, potentially resulting in system compromise.
Recommendation
Update GitPython to version 3.1.59 or later. Avoid writing to config files from untrusted sources.
Original NVD description (English source)
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.