CVE-2026-67326 — GitPython before 3.1.50 Newline Injection via config_writer section
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config…
Published: 2026-08-01 · CVSS: 7.3 · CVSS 4.0
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7