CVE-2026-67326 GitPython before 3.1.50 Newline Injection via config_writer section
Attackers can inject newlines into GitPython config sections to forge hooksPath, enabling remote code execution when git hooks trigger.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-67326?
CVE-2026-67326 is a high-severity code injection vulnerability in gitpython-developers GitPython, published on 1 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.
Weakness: CWE-20
Which versions are affected by CVE-2026-67326?
3 open source packages ship an affected version, including gitpython and GitPython. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gitpython PyPI | All versions | 3.1.50 |
gitpython PyPI | All versions | 3.1.50 |
GitPython PyPI | All versions | 3.1.50 |
Products include Gitpython Project Gitpython.
How do I fix CVE-2026-67326?
Upgrade gitpython to 3.1.50 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-67326 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67326 exists.
Other vulnerabilities in gitpython-developers GitPython
- CVE-2023-40267 GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
- CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection
- CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options
- CVE-2026-42215 GitPython: Command injection via Git options bypass
- CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
Sources
Also known as DEBIAN-CVE-2026-67326, ECHO-4413-137a-6247, ECHO-a193-9c05-86ff, GHSA-gmvg-8p66-77hg, GHSA-mv93-w799-cj2w, MINI-8gf4-6x7r-98x8 and 5 more.