CVE-2026-44244 GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
Attackers can inject newlines into Git config values to set core.hooksPath, leading to remote code execution when Git hooks are triggered.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44244?
CVE-2026-44244 is a high-severity code injection vulnerability in gitpython-developers GitPython, published on 7 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.
Weakness: CWE-94
Which versions are affected by CVE-2026-44244?
3 open source packages ship an affected version, including gitpython and GitPython. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gitpython PyPI | All versions | 3.1.49 |
gitpython PyPI | All versions | 3.1.49 |
GitPython PyPI | All versions | 3.1.49 |
Products include Gitpython Project Gitpython.
How do I fix CVE-2026-44244?
Upgrade gitpython to 3.1.49 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-44244 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44244 exists.
Other vulnerabilities in gitpython-developers GitPython
- CVE-2023-40267 GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
- CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection
- CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options
- CVE-2026-42215 GitPython: Command injection via Git options bypass
- CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
Sources
Also known as CLSA-2026-1784077474, DEBIAN-CVE-2026-44244, ECHO-75d1-905c-5401, GHSA-v87r-6q3f-2j67, MINI-frg6-4pwp-f3xw, MINI-hv35-79fw-5cwj and 3 more.