{"id":"CVE-2026-78676","title":"GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath","summary":"GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newl…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-88","CWE-94"],"vendor":"gitpython_project","product":"gitpython","affected":["gitpython < 3.1.59"],"patched":["gitpython 3.1.59"],"published":"2026-08-25","updated":"2026-10-12","sourceUpdated":"2026-10-12T15:10:00.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78676","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-78676.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-78676"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523197"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78676"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78676"},{"url":"https://access.redhat.com/errata/RHSA-2026:71210"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179"},{"url":"https://access.redhat.com/errata/RHSA-2026:79378"},{"url":"https://access.redhat.com/errata/RHSA-2026:68764"},{"url":"https://access.redhat.com/errata/RHSA-2026:68771"},{"url":"https://access.redhat.com/errata/RHSA-2026:68780"},{"url":"https://access.redhat.com/errata/RHSA-2026:68776"},{"url":"https://github.com/gitpython-developers/GitPython"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3786.yaml"},{"url":"https://github.com/advisories/GHSA-284h-m62q-gf8w"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"}],"tags":["nvd","csaf","vex","red-hat","cve.org","osv","pip","ghsa"],"epss":0.00775,"epssPercentile":0.5558,"aliases":["GHSA-284h-m62q-gf8w","PYSEC-2026-3786"],"ecosystem":"pip","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-08-26T16:08:05.771259Z"},"ingestedAt":"2026-09-03T19:32:11.753Z","slug":"CVE-2026-78676","body":"## Overview\n\nGitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.\n\n## Affected\n\n- `gitpython < 3.1.59`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `gitpython 3.1.59`\n\n## Package advisory (CVE-2026-78676)\n\nAffected packages:\n\n- `gitpython < 3.1.59`\n\nPatched in:\n\n- `gitpython 3.1.59`\n\nSource: https://osv.dev/vulnerability/GHSA-284h-m62q-gf8w\n\n## Vendor advisories\n\n- **RHSA-2026:71210** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71210)\n- **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179)\n- **RHSA-2026:79378** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79378)\n- **RHSA-2026:68764** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68764)\n- **RHSA-2026:68771** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68771)\n- **RHSA-2026:68780** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68780)\n- **RHSA-2026:68776** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68776)\n- **Red Hat VEX** · Critical · affected: Exploit Intelligence, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenStack Platform 16.2, … · no fix planned: Exploit Intelligence, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-78676.json)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[{"seq":5476,"id":"CVE-2026-78676","ts":1788887288537,"field":"cvss","old":null,"new":"9.8"},{"seq":5475,"id":"CVE-2026-78676","ts":1788887288537,"field":"severity","old":"none","new":"critical"},{"seq":4359,"id":"CVE-2026-78676","ts":1788886401261,"field":"cvss","old":"9.8","new":null},{"seq":4358,"id":"CVE-2026-78676","ts":1788886401261,"field":"severity","old":"critical","new":"none"},{"seq":3179,"id":"CVE-2026-78676","ts":1788883133261,"field":"cvss","old":null,"new":"9.8"},{"seq":3178,"id":"CVE-2026-78676","ts":1788883133261,"field":"severity","old":"none","new":"critical"}]}