Config-Name Injection Vulnerability in GitPython by GitPython Developers

CVE-2026-76221

What is CVE-2026-76221?

GitPython, prior to version 3.1.58, exhibits a config-name injection vulnerability within its option-name validator. This flaw enables attackers to manipulate git-config directives by injecting characters such as equals signs, hash symbols, and whitespace into the option names. Malicious actors could exploit this vulnerability by crafting harmful option names—such as 'sshCommand = touch /tmp/RCE #'—to force the execution of arbitrary commands during subsequent git operations, potentially leading to severe security breaches. Proper updates and security measures should be taken to mitigate the risks associated with this vulnerability.

References