CVE-2026-67326
Received Received - Intake

GitPython Config Injection Leading to RCE

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67326
EUVD
EUVD-2026-51814

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gitpython gitpython to 3.1.50 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GitPython before 3.1.50 does not properly check newline characters in the config_writer() section parameter. Attackers can inject newlines to create fake section headers in .git/config, such as a forged [core] section with hooksPath pointing to malicious directories. This can lead to remote code execution when Git hooks are triggered.

Detection Guidance

Check GitPython version with pip show GitPython. If version is below 3.1.50, the system is vulnerable. Inspect .git/config files for unexpected newline characters or forged [core] sections.

Impact Analysis

If exploited, attackers could execute arbitrary code on your system by tricking Git into running malicious hooks. This could allow unauthorized access, data theft, or system compromise, depending on the hooks configured.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Organizations may face compliance breaches if attackers access or manipulate sensitive data.

Mitigation Strategies

Upgrade GitPython to version 3.1.50 or later. Review .git/config files for unauthorized changes. Implement input validation for config_writer() section parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67326. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart