GitPython Config Write Arbitrary Code Execution via Malicious Git Config

Executive Summary

CVE-2026-78676 is a high-severity vulnerability in GitPython versions before 3.1.59. It allows remote code execution through a config injection attack. The issue occurs when GitPython corrupts dormant multi-line git-config values during write operations, transforming them into executable directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect GitPython versions in use with: pip show GitPython. Check for multi-line config values in .git/config or included files that could contain embedded newlines. Use git config --list --show-origin to review active config directives. Look for suspicious hooksPath or similar directives pointing to unexpected paths.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code on your system if you use a vulnerable version of GitPython to modify Git config files. Attackers can inject malicious directives into config files by embedding newlines in values. When GitPython rewrites the config, these dormant values become active, enabling execution of attacker-controlled hooks during normal Git operations like commits.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution via Git hooks, potentially allowing attackers to access, modify, or exfiltrate sensitive data. For GDPR, this may result in violations of data integrity and confidentiality. For HIPAA, it could compromise protected health information if exploited in healthcare environments.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade GitPython to version 3.1.59 or later immediately. Avoid using GitPython to modify Git config files until patched. If config writes are necessary, use git's native config tools instead. Review all .git/config and included files for multi-line values with embedded newlines.

Useful 0 Not Useful 0