CVE-2026-76221 GitPython before 3.1.58 Config Injection via option-name
Attackers can inject malicious git-config directives to execute arbitrary commands via core.sshCommand or core.hooksPath in GitPython.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-76221?
CVE-2026-76221 is a high-severity command injection vulnerability in gitpython-developers GitPython, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.
Weakness: CWE-74
Which versions are affected by CVE-2026-76221?
3 open source packages ship an affected version, including gitpython and GitPython. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gitpython PyPI | All versions | 3.1.58 |
gitpython PyPI | All versions | 3.1.58 |
GitPython PyPI | All versions | 3.1.58 |
Products include Gitpython Project Gitpython.
How do I fix CVE-2026-76221?
Upgrade gitpython to 3.1.58 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-76221 being exploited?
There is no known exploitation of CVE-2026-76221 in the wild and no public exploit code.
Other vulnerabilities in gitpython-developers GitPython
- CVE-2023-40267 GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
- CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection
- CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options
- CVE-2026-42215 GitPython: Command injection via Git options bypass
- CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
Sources
Also known as CLSA-2026-1787219647, DEBIAN-CVE-2026-76221, ECHO-2c16-7ddc-9a15, ECHO-9a71-300c-8276, GHSA-78pq-g4m8-fx2c, GHSA-jm78-9fvv-mhgr and 8 more.