https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 13:33:22 +0000 https://vulnerability.circl.lu/vuln/cve-2026-67326 <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.</p> <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.</p> https://vulnerability.circl.lu/vuln/cve-2026-67326 https://vulnerability.circl.lu/vuln/ghsa-mv93-w799-cj2w <p><strong>Affected:</strong> PyPI: GitPython</p> <p>Summary</p> <p>The patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value(). The section and option parameters are passed to configparser without any newline validation. An attacker who controls the section argument can inject \n to write arbitrary section headers into .git/config, including a forged [core] section with hooksPath pointing to an attacker-controlled directory, leading to RCE when any git hook is triggered.</p> <p>Details</p> <p>File: git/config.py — GitPython 3.1.49 (latest patched version)</p> <p>```python def set_value(self, section: str, option: str, value) -&gt; &#34;GitConfigParser&#34;: value_str = self._value_to_string_safe(value) # only value is validated if not self.has_section(section): self.add_section(section) # section not validated super().set(section, option, value_str) # option not validated return self ```</p> <p>_write() formats section headers as &#34;[%s]\n&#34; % name. When section = &#34;user]\n[core&#34;, this writes [user]\n[core]\n — two valid section headers — into .git/config.</p> <p>PoC</p> <p>```python import git, os, subprocess</p> <p>repo = git.Repo.init(&#34;/tmp/bypass_test&#34;)</p> <p>os.makedirs(&#34;/tmp/evil_hooks&#34;, exist_ok=True) with open(&#34;/tmp/evil_hooks/pre-commit&#34;, &#34;w&#34;) as f: f.write(&#34;#!/bin/sh\nid &gt; /tmp/rce_proof.txt\n&#34;) os.chmod(&#34;/tmp/evil_hooks/pre-commit&#34;, 0o755)</p> <p># Inject newline into section parameter (not value — already patched) with repo.config_writer() as cw:…</p> <p><strong>Affected:</strong> PyPI: GitPython</p> <p>Summary</p> <p>The patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value(). The section and option parameters are passed to configparser without any newline validation. An attacker who controls the section argument can inject \n to write arbitrary section headers into .git/config, including a forged [core] section with hooksPath pointing to an attacker-controlled directory, leading to RCE when any git hook is triggered.</p> <p>Details</p> <p>File: git/config.py — GitPython 3.1.49 (latest patched version)</p> <p>```python def set_value(self, section: str, option: str, value) -&gt; &#34;GitConfigParser&#34;: value_str = self._value_to_string_safe(value) # only value is validated if not self.has_section(section): self.add_section(section) # section not validated super().set(section, option, value_str) # option not validated return self ```</p> <p>_write() formats section headers as &#34;[%s]\n&#34; % name. When section = &#34;user]\n[core&#34;, this writes [user]\n[core]\n — two valid section headers — into .git/config.</p> <p>PoC</p> <p>```python import git, os, subprocess</p> <p>repo = git.Repo.init(&#34;/tmp/bypass_test&#34;)</p> <p>os.makedirs(&#34;/tmp/evil_hooks&#34;, exist_ok=True) with open(&#34;/tmp/evil_hooks/pre-commit&#34;, &#34;w&#34;) as f: f.write(&#34;#!/bin/sh\nid &gt; /tmp/rce_proof.txt\n&#34;) os.chmod(&#34;/tmp/evil_hooks/pre-commit&#34;, 0o755)</p> <p># Inject newline into section parameter (not value — already patched) with repo.config_writer() as cw:…</p> https://vulnerability.circl.lu/vuln/ghsa-mv93-w799-cj2w https://vulnerability.circl.lu/vuln/pysec-2026-3980 <p><strong>Affected:</strong> PyPI: gitpython</p> <p>GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.</p> <p><strong>Affected:</strong> PyPI: gitpython</p> <p>GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.</p> https://vulnerability.circl.lu/vuln/pysec-2026-3980