Command Injection Affecting gitpython package, versions [,3.1.50)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-GITPYTHON-16624542
- published11 May 2026
- disclosed8 May 2026
- creditaslein1413-sys aslein
Introduced: 8 May 2026
CVE NOT AVAILABLE CWE-78 (opens in a new tab)How to fix?
Upgrade GitPython to version 3.1.50 or higher.
Overview
GitPython is a python library used to interact with Git repositories
Affected versions of this package are vulnerable to Command Injection via the set_value function when the section parameter is not properly validated for newline characters. An attacker can execute arbitrary code by injecting malicious section headers into the .git/config file, which can redirect core.hooksPath to an attacker-controlled directory and trigger execution when a git hook runs.
Note: This vulnerability bypasses the patch for CVE-2026-42215.