Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76221GitPython before 3.1.58 Config Injection via option-name

High 8.8

In plain English

A high-severity injection in GitPython from gitpython-developers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 58.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	py3-gitpython	3.1.61-r0	ALPINE-CVE-2026-76221
Debian:12	python-git	3.1.30-1+deb12u3	DEBIAN-CVE-2026-76221
Debian:13	python-git	3.1.44-1+deb13u1	DEBIAN-CVE-2026-76221
Debian:14	python-git	3.1.61-1	DEBIAN-CVE-2026-76221
PyPI	gitpython	3.1.58	PYSEC-2026-3783
PyPI	gitpython	3.1.58	GHSA-jm78-9fvv-mhgr
Ubuntu:26.10	python-git	no fix listed	UBUNTU-CVE-2026-76221

Affected products (as reported)

Vendor	Product	Versions
gitpython-developers	GitPython	0 – before 3.1.58

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-jm78-9fvv-mhgr) vendor-advisory
VulnCheck Advisory: GitPython before 3.1.58 Config Injection via option-name third-party-advisory