Tag
GitPython config_writer() Newline Injection Bypasses CVE-2026-42215 Patch
2 rules 3 TTPs 1 CVEAn incomplete patch for CVE-2026-42215 in GitPython allows newline injection in the section parameter of the config_writer() function, enabling arbitrary .git/config modification and remote code execution via core.hooksPath.
GitPython Vulnerability Allows Arbitrary Code Execution via Git Hooks
2 rules 1 TTP 1 CVEA vulnerability in GitPython versions prior to 3.1.47 allows for command execution during repository cloning by manipulating the `multi_options` parameter to inject malicious Git configurations, such as `core.hooksPath`, leading to the execution of attacker-controlled hooks.
GitPython Command Injection Vulnerability
2 rules 1 TTPGitPython versions 3.1.30 through 3.1.46 are vulnerable to command injection by passing attacker-controlled kwargs into `Repo.clone_from()`, `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`, leading to arbitrary command execution due to bypassed safety checks.
GitPython Path Traversal Vulnerability Allows Arbitrary File Manipulation
3 rules 1 TTPA path traversal vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations.
GitPython config_writer().set_value() Newline Injection RCE
2 rules 1 TTPA newline injection vulnerability in GitPython's `config_writer().set_value()` function enables remote code execution by manipulating the `core.hooksPath` Git configuration.