https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 21:29:44 +0000 https://vulnerability.circl.lu/vuln/cve-2026-76221 <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like &#39;sshCommand = touch /tmp/RCE #&#39; to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.</p> <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like &#39;sshCommand = touch /tmp/RCE #&#39; to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.</p> https://vulnerability.circl.lu/vuln/cve-2026-76221 https://vulnerability.circl.lu/vuln/ghsa-jm78-9fvv-mhgr <p><strong>Affected:</strong> PyPI: GitPython</p> <p>## Summary GitPython&#39;s config-name validator only neutralizes CR/LF/NUL for the `&#34;option&#34;` label; it does not reject `=`, `#`, `;`, `[`, `]`, or whitespace in an **option name**. `write_section` writes the option name verbatim into the config file, so an option name such as `sshCommand = touch &lt;cmd&gt; #` is written as `\tsshCommand = touch &lt;cmd&gt; # = &lt;value&gt;`, which git parses as `core.sshCommand = touch &lt;cmd&gt;` (the trailing `#` comments out the intended value). This forges arbitrary config directives (`core.sshCommand`, `core.hooksPath`, `alias.*`) → RCE on the next git operation. This is a distinct field (option name, not section name) and distinct character class (`=`/`#`/space, not newline/bracket) from GHSA-3rp5-jjmw-4wv2 (section-name bracket injection) and GHSA-mv93-w799-cj2w / GHSA-v87r-6q3f-2j67 (newline injection).</p> <p>## Root Cause `_assure_config_name_safe(name, label)` (`git/config.py:897`) applies the bracket/quote state machine ONLY when `label == &#34;section&#34;`; for the `&#34;option&#34;` label it falls through with just the `UNSAFE_CONFIG_CHARS_RE = [\r\n\x00]` regex. `write_section` then writes the option name verbatim into `&#34;\t%s = %s\n&#34;` (config.py:702).</p> <p>## Impact Arbitrary git-config directive injection → remote code execution via `core.sshCommand` (fires on any ssh git operation, no staged file needed) or `core.hooksPath` (with a staged hook). Requires the embedding application to forward a caller-influenced OPTION NAME into the config writer (name-control model, the sa…</p> <p><strong>Affected:</strong> PyPI: GitPython</p> <p>## Summary GitPython&#39;s config-name validator only neutralizes CR/LF/NUL for the `&#34;option&#34;` label; it does not reject `=`, `#`, `;`, `[`, `]`, or whitespace in an **option name**. `write_section` writes the option name verbatim into the config file, so an option name such as `sshCommand = touch &lt;cmd&gt; #` is written as `\tsshCommand = touch &lt;cmd&gt; # = &lt;value&gt;`, which git parses as `core.sshCommand = touch &lt;cmd&gt;` (the trailing `#` comments out the intended value). This forges arbitrary config directives (`core.sshCommand`, `core.hooksPath`, `alias.*`) → RCE on the next git operation. This is a distinct field (option name, not section name) and distinct character class (`=`/`#`/space, not newline/bracket) from GHSA-3rp5-jjmw-4wv2 (section-name bracket injection) and GHSA-mv93-w799-cj2w / GHSA-v87r-6q3f-2j67 (newline injection).</p> <p>## Root Cause `_assure_config_name_safe(name, label)` (`git/config.py:897`) applies the bracket/quote state machine ONLY when `label == &#34;section&#34;`; for the `&#34;option&#34;` label it falls through with just the `UNSAFE_CONFIG_CHARS_RE = [\r\n\x00]` regex. `write_section` then writes the option name verbatim into `&#34;\t%s = %s\n&#34;` (config.py:702).</p> <p>## Impact Arbitrary git-config directive injection → remote code execution via `core.sshCommand` (fires on any ssh git operation, no staged file needed) or `core.hooksPath` (with a staged hook). Requires the embedding application to forward a caller-influenced OPTION NAME into the config writer (name-control model, the sa…</p> https://vulnerability.circl.lu/vuln/ghsa-jm78-9fvv-mhgr https://vulnerability.circl.lu/vuln/pysec-2026-3783 <p><strong>Affected:</strong> PyPI: gitpython</p> <p>GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like &#39;sshCommand = touch /tmp/RCE #&#39; to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.</p> <p><strong>Affected:</strong> PyPI: gitpython</p> <p>GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like &#39;sshCommand = touch /tmp/RCE #&#39; to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.</p> https://vulnerability.circl.lu/vuln/pysec-2026-3783