GitPython Configuration-Name Injection Vulnerability

GitPython, a widely used Python library for interacting with Git repositories, contains a configuration-name injection vulnerability in its option-name validator (CVE-2026-76221). The vulnerability exists in all versions prior to 3.1.58. It stems from improper neutralization of special characters - specifically equals signs, hash symbols, and whitespace - within the option-name validation logic.

An attacker capable of influencing the arguments passed to GitPython's configuration management functions can inject arbitrary git-config directives. By crafting malicious option names such as 'sshCommand = [command] #', an attacker can manipulate sensitive Git configuration keys like 'core.sshCommand' or 'core.hooksPath'. When the affected system performs a subsequent Git operation, the injected configuration is honored, leading to remote code execution (RCE) in the context of the user running the GitPython-powered application. This vulnerability is significant for CI/CD pipelines, web-based repository viewers, and automated build tools that leverage GitPython to process untrusted repository metadata.

Impact

Successful exploitation allows for arbitrary command execution on systems running applications that use affected versions of GitPython. Given GitPython's prevalence in developer tooling, CI/CD runners, and automated security scanning platforms, the impact includes unauthorized code execution, potential pipeline compromise, and lateral movement within the development environment.

Recommendation

• Upgrade GitPython to version 3.1.58 or later immediately across all environments.
• Audit applications using GitPython to ensure they do not pass unsanitized user-controlled input into Git configuration methods or option-name validators.
• Monitor for suspicious git-related configuration changes, such as unexpected setting of 'core.sshCommand' or 'core.hooksPath' via process command-line auditing.