{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/gitpython--3.1.58/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-78676"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitPython (\u003c 3.1.59)","GitPython (\u003c= 3.1.58)","GitPython (\u003c 3.1.58)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","path-traversal","gitpython","supply-chain","info-disclosure","local-file-inclusion"],"_cs_type":"advisory","_cs_vendors":["GitPython"],"content_html":"\u003cp\u003eGitPython is a Python library used to interact with Git repositories. A critical vulnerability (CVE-2026-78676) exists in versions prior to 3.1.59 due to improper re-serialization of multi-line configuration values during git-config write operations. An attacker can supply a specially crafted configuration value containing embedded newlines. When GitPython performs a write operation on the configuration file, these newlines cause the injected content to be interpreted as new, live git configuration directives. A primary vector involves the injection of a malicious \u003ccode\u003ecore.hooksPath\u003c/code\u003e, which directs Git to execute arbitrary code from a location controlled by the attacker whenever a Git hook is triggered. This vulnerability enables unauthenticated remote code execution in environments where GitPython processes untrusted configuration data.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker provides a malicious, multi-line string intended to be written to a \u003ccode\u003e.git/config\u003c/code\u003e file (e.g., through an application interface using GitPython).\u003c/li\u003e\n\u003cli\u003eThe application uses the vulnerable GitPython library to update the repository configuration with the attacker-controlled input.\u003c/li\u003e\n\u003cli\u003eGitPython fails to escape or neutralize the newline characters within the input string during the serialization process.\u003c/li\u003e\n\u003cli\u003eThe serialized output is written to the \u003ccode\u003e.git/config\u003c/code\u003e file, effectively terminating the intended configuration key and starting a new directive on the subsequent line.\u003c/li\u003e\n\u003cli\u003eThe injected directive, such as \u003ccode\u003ecore.hooksPath = /tmp/malicious_hooks_dir\u003c/code\u003e, is successfully written into the configuration file.\u003c/li\u003e\n\u003cli\u003eThe system or user triggers a standard Git operation (e.g., \u003ccode\u003egit commit\u003c/code\u003e or \u003ccode\u003egit push\u003c/code\u003e) within the repository.\u003c/li\u003e\n\u003cli\u003eGit reads the corrupted configuration file and executes the malicious scripts located in the attacker-specified hooks directory.\u003c/li\u003e\n\u003cli\u003eFinal objective achieved: Remote code execution under the context of the user running the Git operation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability carries a CVSS score of 9.8, indicating a critical risk of complete system compromise. Successful exploitation allows for unauthenticated remote code execution, which can lead to data exfiltration, unauthorized access to internal development environments, and the deployment of persistent backdoors within software supply chains. Any system or automated pipeline utilizing GitPython to manage repository configurations with untrusted input is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eGitPython\u003c/code\u003e library to version 3.1.59 or later immediately to address CVE-2026-78676.\u003c/li\u003e\n\u003cli\u003eAudit application code that passes user-supplied input to GitPython's configuration write functions.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation to ensure configuration values do not contain newline characters or unexpected git directives.\u003c/li\u003e\n\u003cli\u003eReview logs for unauthorized modifications to \u003ccode\u003e.git/config\u003c/code\u003e files within critical infrastructure or CI/CD environments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-08T20:05:15Z","date_published":"2026-08-25T04:05:22Z","id":"https://feed.craftedsignal.io/briefs/2026-08-gitpython-rce/","summary":"GitPython versions before 3.1.59 contain a vulnerability where improper sanitization of multi-line configuration values allows attackers to inject arbitrary git directives, leading to remote code execution.","title":"Remote Code Execution in GitPython via Git Config Injection","url":"https://feed.craftedsignal.io/briefs/2026-08-gitpython-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - GitPython (\u003c= 3.1.58)","version":"https://jsonfeed.org/version/1.1"}