Critical severity · published Aug 25, 2026
CVE-2026-78676
GitPython before 3.1.59 Remote Code Execution via Config Injection
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
GitPython · gitpython-developers
before 3.1.59 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78676
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78676
vendor-advisory
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w
third-party-advisory
https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection
More from GitPython
9.8
CVE-2026-67324
GitPython 3.1.50 Authentication Bypass via Joined Short Options
9.8
CVE-2026-42284
GitPython: Unsafe option check validates multi_options before shlex.split transforms it
8.8
CVE-2026-87817
GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
8.8
CVE-2026-76221
GitPython before 3.1.58 Config Injection via option-name
8.8
CVE-2026-76220
GitPython before 3.1.58 Command Execution via split_single_char_options