Injection Flaw in GitPython Library Affects Git Operations

CVE-2026-44244

What is CVE-2026-44244?

An injection flaw in GitPython, a library designed for interacting with Git repositories, allows for the unvalidated insertion of values into configuration files. Prior to version 3.1.49, the 'set_value()' function would pass unvalidated values to Python's configparser, enabling embedded newlines. This could lead to the injection of malicious paths that are executed during Git operations such as commits and merges, as they trigger scripts from attacker-controlled directories. The vulnerability emphasizes the necessity of validation in configuration handling to prevent arbitrary code execution.

References