Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-01T12:22:18 gitpython: GitPython: Remote Code Execution via Newline Injection in config_writer() 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-93

GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.

A flaw was found in GitPython. This vulnerability allows attackers to inject newline characters into the `section` parameter of the `config_writer()` function, leading to the injection of arbitrary section headers into the `.git/config` file. By forging a `[core]` section with a malicious `hooksPath`, an attacker can achieve remote code execution when Git hooks are subsequently triggered.

Red Hat Hardened Images 2026-07-23T00:00:00Z RHSA-2026:44416 llvm-main-22.1.8-4.1.hum1 Red Hat Hardened Images 2026-07-25T00:00:00Z RHSA-2026:45785 swift-lang-main-6.3.3-0.1.1.hum1 Red Hat Hardened Images 2026-07-26T00:00:00Z RHSA-2026:45940 llvm21-main-21.1.8-8.hum1 Red Hat Hardened Images Not affected rust https://www.cve.org/CVERecord?id=CVE-2026-67326 https://nvd.nist.gov/vuln/detail/CVE-2026-67326 https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w https://www.vulncheck.com/advisories/gitpython-before-newline-injection-via-config-writer-section