Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-78676GitPython before 3.1.59 Remote Code Execution via Config Injection

Critical 9.8

In plain English

A critical-severity argument injection in GitPython from gitpython-developers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 53.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	py3-gitpython	3.1.61-r0	ALPINE-CVE-2026-78676
Debian:12	python-git	3.1.30-1+deb12u3	DEBIAN-CVE-2026-78676
Debian:13	python-git	3.1.44-1+deb13u1	DEBIAN-CVE-2026-78676
Debian:14	python-git	3.1.61-1	DEBIAN-CVE-2026-78676
PyPI	gitpython	3.1.59	GHSA-284h-m62q-gf8w
PyPI	gitpython	3.1.59	PYSEC-2026-3786

Affected products (as reported)

Vendor	Product	Versions
gitpython-developers	GitPython	0 – before 3.1.59

Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-284h-m62q-gf8w) vendor-advisory
VulnCheck Advisory: GitPython before 3.1.59 Remote Code Execution via Config Injection third-party-advisory