Skip to content
Threat Feed

Tag

Gitpython

5 briefs RSS
high advisory

GitPython config_writer() Newline Injection Bypasses CVE-2026-42215 Patch

An incomplete patch for CVE-2026-42215 in GitPython allows newline injection in the section parameter of the config_writer() function, enabling arbitrary .git/config modification and remote code execution via core.hooksPath.

GitPython newline-injection rce code-injection
2r 3t 1c
high advisory

GitPython Vulnerability Allows Arbitrary Code Execution via Git Hooks

A vulnerability in GitPython versions prior to 3.1.47 allows for command execution during repository cloning by manipulating the `multi_options` parameter to inject malicious Git configurations, such as `core.hooksPath`, leading to the execution of attacker-controlled hooks.

GitPython code-execution git-hooks command-injection
2r 1t 1c
high advisory

GitPython Command Injection Vulnerability

GitPython versions 3.1.30 through 3.1.46 are vulnerable to command injection by passing attacker-controlled kwargs into `Repo.clone_from()`, `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`, leading to arbitrary command execution due to bypassed safety checks.

GitPython command-injection vulnerability
2r 1t
high advisory

GitPython Path Traversal Vulnerability Allows Arbitrary File Manipulation

A path traversal vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations.

GitPython path-traversal file-manipulation
3r 1t
high advisory

GitPython config_writer().set_value() Newline Injection RCE

A newline injection vulnerability in GitPython's `config_writer().set_value()` function enables remote code execution by manipulating the `core.hooksPath` Git configuration.

GitPython newline injection remote code execution config poisoning
2r 1t