CVE-2026-76221 — GitPython before 3.1.58 Config Injection via option-name
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting e…
Published: 2026-08-19 · CVSS: 8.7 · CVSS 4.0
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7