CVE-2026-67326 in GitPython
Summary
by MITRE • 08/01/2026
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in GitPython versions prior to 3150 represents a critical configuration injection flaw that undermines the integrity of git repository configurations. This issue stems from inadequate input validation within the config_writer() method where the section parameter fails to sanitize newline characters, creating an avenue for malicious actors to manipulate repository settings through crafted configuration inputs.
The technical implementation of this vulnerability exploits the lack of proper sanitization in the configuration writing process. When attackers provide section names containing newline characters, these characters are not properly escaped or validated before being written to the .git/config file. This allows adversaries to inject additional section headers that can override or extend existing configuration settings with malicious intent.
The operational impact of this vulnerability extends beyond simple configuration manipulation to potentially enable remote code execution through carefully crafted hook configurations. By injecting a forged [core] section with hooksPath pointing to attacker-controlled directories, threat actors can ensure that subsequent git operations trigger their malicious payloads when hooks are executed. This represents a sophisticated attack vector that leverages the legitimate git configuration system to establish persistent execution points within target repositories.
The vulnerability aligns with CWE-15 Input Validation and CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, demonstrating how inadequate sanitization of user-provided parameters can create dangerous injection opportunities. From an attack perspective, this flaw maps to ATT&CK technique T1059 Command and Scripting Interpreter and T1566 Phishing, as it enables attackers to establish execution footholds through modified repository configurations that are subsequently triggered during normal git operations.
Security mitigations for this vulnerability require immediate patching of GitPython to version 3.1.50 or later where proper newline validation has been implemented. Organizations should also conduct comprehensive audits of their git repositories to identify any potential malicious configuration injections that may have already occurred. Additional protective measures include implementing automated monitoring for unexpected changes to .git/config files and establishing strict access controls for repository configuration modifications.
The broader implications of this vulnerability highlight the importance of input validation in all components that interact with system configuration files, particularly those that are executed as part of routine operations. This flaw demonstrates how seemingly innocuous parameter handling can create significant security risks when proper sanitization measures are not implemented, emphasizing the need for comprehensive security testing of all configuration management functions within software systems.
Organizations should also consider implementing additional safeguards such as file integrity monitoring for .git/config files and regular security scanning of repository configurations to detect unauthorized modifications. The vulnerability serves as a reminder that even well-established tools like GitPython require ongoing security scrutiny, particularly when handling user-provided inputs that can influence system behavior through configuration files.