CVE-2026-78676 in GitPython
Summary
by MITRE • 08/25/2026
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in GitPython versions prior to 3.1.59 represents a critical configuration parsing and serialization flaw within the library's handling of multi-line values stored in git-config files. This issue stems from an improper neutralization or sanitization mechanism when the application attempts to re-serialize configuration data back into its file format after modification operations. Specifically, GitPython failed to correctly preserve the quoting structure of multi-line strings during write operations. In standard git-config syntax, certain characters and sequences require specific escaping or quoting to be interpreted literally rather than as structural delimiters or directives. When a value containing embedded newlines is read by vulnerable versions of GitPython, it is stored internally in a manner that loses its original formatting context. Upon subsequent serialization for writing back to the configuration file, these values are reconstructed without the necessary protective quotes or escape sequences, effectively flattening multi-line content into single lines and stripping away the syntactic boundaries that prevent interpretation as active commands.
This technical flaw creates a severe security risk known as Configuration Injection, which falls under CWE-94 Improper Control of Generation of Code (Code Injection) and specifically relates to CWE-15 External Control of Critical State Data. The operational impact is particularly dangerous because it allows for arbitrary code execution through the manipulation of Git hooks. An attacker can craft a malicious git-config file containing embedded newlines within specific configuration values. When this corrupted config is processed by an application using vulnerable versions of GitPython, any subsequent unrelated write operation to the configuration triggers the flawed serialization logic. This process inadvertently transforms dormant quoted strings into active git directives. A prime example cited in security advisories involves the core.hooksPath directive. By injecting a newline that alters how the parser interprets the path or by directly manipulating values associated with hook execution, an attacker can redirect Git to execute arbitrary scripts located at paths of their choosing whenever standard Git operations are performed on repositories configured with this tampered state.
The exploitation scenario typically involves social engineering or supply chain compromise where a victim is induced to use a repository or configuration file containing the maliciously crafted multi-line values. Once the vulnerable GitPython library processes these files, even if the attacker does not directly invoke the hook immediately, the mere act of reading and then writing any part of that configuration can trigger the corruption. This results in the creation of live git hooks pointing to executable payloads on the victim's system. Consequently, routine version control operations such as commits, pulls, or pushes will execute the injected code with the privileges of the user running GitPython. This bypasses traditional security controls because the execution is initiated by a trusted development tool acting under legitimate user permissions, making detection difficult without deep behavioral monitoring.
Mitigation strategies for this vulnerability are straightforward and primarily involve updating dependencies to patched versions. Organizations utilizing Python-based version control tools must upgrade GitPython to version 3.1.59 or later, where the serialization logic has been corrected to properly handle multi-line values by preserving their quoting structure during write operations. In addition to dependency updates, developers should implement strict input validation and sanitization routines for any configuration data that is read from external sources before processing it with GitPython. It is also advisable to audit existing git-config files in repositories managed or generated by applications using this library to ensure no dormant malicious directives have been injected into the system state. Security teams should monitor for unusual hook executions or unexpected script invocations during standard Git operations, as these may indicate that a configuration injection attack has already taken place and requires immediate remediation of both the software vulnerability and any compromised configurations.