CVE-2026-78676: GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
- CWE: CWE-88 (Argument Injection) / CWE-94 (Code Injection) — via a read-then-corrupt-on-rewrite config round trip, not a direct setter argument
- Affected component:
git/config.py—GitConfigParser._read()(multi-line value decoding, lines 444-541, esp.string_decode()at line 460 and its call sites at 519/541) andGitConfigParser._write()/write_section()(serialization, lines ~694-712, esp. line 708) - Affected version: GitPython at HEAD (
9729ed3b948f2bde09f1f188c5311e172212b67e, 2026-08-05, VERSION3.1.58)
References
- github.com/advisories/GHSA-284h-m62q-gf8w
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w
- github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3786.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-78676
- www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection
Code Behaviors & Features
Detect and mitigate CVE-2026-78676 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →