CVE-2026-67326 Details
Description
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.
A newline injection vulnerability has been identified in GitPython versions prior to 3.1.50. The issue arises because the library fails to properly validate newline characters in the section parameter of the config_writer() function. This oversight allows attackers to inject arbitrary section headers into the .git/config file. By exploiting this vulnerability, an attacker can create a forged [core] section with hooksPath directed to a directory under their control. This setup can lead to remote code execution when the injected git hooks are triggered.
Users are advised to update GitPython to version 3.1.50 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w | CISA-ADP | ExploitVendor Advisory |
| https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w | [email protected] | ExploitVendor Advisory |
| https://www.vulncheck.com/advisories/gitpython-before-newline-injection-via-config-writer-section | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gitpython project gitpython | < 3.1.50 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | Initial Analysis | [email protected] |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |