CVE-2026-76221
Received Received - Intake

Config-name Injection in GitPython Prior to 3.1.58

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76221
EUVD
EUVD-2026-62462

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gitpython gitpython to 3.1.58 (exc)
gitpython_developers gitpython to 3.1.58 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GitPython before 3.1.58 has a config-name injection vulnerability in its option-name validator. Attackers can inject malicious git-config directives by using special characters like equals signs, hash symbols, and whitespace in option names. For example, an option name like 'sshCommand = touch /tmp/RCE #' can be crafted to execute arbitrary commands via core.sshCommand or core.hooksPath during subsequent Git operations.

Detection Guidance

Check GitPython version with 'pip show gitpython' or 'gitpython --version'. Inspect git config files for suspicious option names containing special characters like =, #, or whitespace. Monitor for unexpected git operations or SSH commands.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your system when you perform Git operations. If an attacker can manipulate GitPython's config files, they could run malicious code via SSH or hooks, potentially leading to full system compromise or data theft.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or loss of sensitive information. Such incidents may violate compliance requirements under GDPR, HIPAA, or other regulations, leading to legal penalties, reputational damage, and mandatory breach notifications.

Mitigation Strategies

Upgrade GitPython to version 3.1.58 or later immediately. Temporarily restrict write access to git config files. Review and audit all git config files for malicious entries. Disable core.sshCommand and core.hooksPath if not needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76221. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart