CVE-2026-44244

A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.set_value() function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Git repository. Consequently, any Git operation that triggers hooks, such as committing or merging, could lead to arbitrary code execution from an attacker-controlled path.

This is an Important flaw in GitPython that allows for arbitrary code execution. By injecting newlines into Git configuration values, an attacker can manipulate the core.hooksPath to execute malicious scripts during standard Git operations. This poses a significant risk in environments where applications process unvalidated user input when interacting with Git repositories, potentially leading to persistent repository configuration poisoning.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, applications that use GitPython and process untrusted input for Git configuration values must implement robust input validation and sanitization. This prevents the injection of newlines that could manipulate core.hooksPath and lead to arbitrary code execution. Additionally, ensure that applications interacting with Git repositories operate with the principle of least privilege to limit the potential impact of any successful exploitation.