Vulnerability	Vulnerable Version
H Command Injection GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Command Injection via the `set_value` function when the `section` parameter is not properly validated for newline characters. An attacker can execute arbitrary code by injecting malicious section headers into the `.git/config` file, which can redirect `core.hooksPath` to an attacker-controlled directory and trigger execution when a git hook runs. Note: This vulnerability bypasses the patch for CVE-2026-42215. How to fix Command Injection? Upgrade `GitPython` to version 3.1.50 or higher.	[,3.1.50)
H Arbitrary Code Injection GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Code Injection via the `set_value` function. An attacker can achieve arbitrary code execution by injecting newline characters into configuration values, which allows the creation of malicious Git configuration entries such as `core.hooksPath`. This enables execution of attacker-controlled scripts during Git operations that invoke hooks. How to fix Arbitrary Code Injection? Upgrade `GitPython` to version 3.1.49 or higher.	[,3.1.49)

Command Injection

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Command Injection via the set_value function when the section parameter is not properly validated for newline characters. An attacker can execute arbitrary code by injecting malicious section headers into the .git/config file, which can redirect core.hooksPath to an attacker-controlled directory and trigger execution when a git hook runs.

Note: This vulnerability bypasses the patch for CVE-2026-42215.

How to fix Command Injection?

Upgrade GitPython to version 3.1.50 or higher.

[,3.1.50)

Arbitrary Code Injection

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Arbitrary Code Injection via the set_value function. An attacker can achieve arbitrary code execution by injecting newline characters into configuration values, which allows the creation of malicious Git configuration entries such as core.hooksPath. This enables execution of attacker-controlled scripts during Git operations that invoke hooks.

How to fix Arbitrary Code Injection?

Upgrade GitPython to version 3.1.49 or higher.

[,3.1.49)

Go back to all versions of this package