GitPython, a Python library used to interact with Git repositories, is vulnerable to a newline injection attack in its config_writer() function. This vulnerability, tracked as CVE-2026-67326, allows attackers to inject arbitrary section headers into a Git repository's .git/config file. By exploiting this vulnerability, attackers can create a forged [core] section with a hooksPath pointing to attacker-cont [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:02.923Z and has not been modified since then. GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p ins [truncated]
CRITICALgitpython-developersCVE published 2026-08-01
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:02.770Z and has not been modified since then. GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> when enforcing its default unsafe-option gate. An attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specifie [truncated]
GitPython before 3.1.51 is vulnerable to command injection via unguarded Git options in Repo.archive() and git.ls_remote(). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, which can cause Git to open and truncate an arbitrary file. This vulnerability affects developers and administrators using GitPython in their applications, potentially leading to arbi [truncated]
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The vulnerability allows an attacker who controls the clone URL to embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables. This issue affects GitPython users, developers, and administrators, who should be aware of this vulnerability and take necessary actio [truncated]
