CVE-2026-67326 Overview
CVE-2026-67326 is an input validation vulnerability [CWE-20] in GitPython versions before 3.1.50. The library fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers who control the section name can forge a [core] section containing a hooksPath directive that points to attacker-controlled directories. When subsequent git operations trigger hooks, the injected path executes attacker-supplied scripts, resulting in local code execution on the host running GitPython.
Critical Impact
Successful exploitation grants arbitrary code execution in the context of the user invoking GitPython, compromising confidentiality, integrity, and availability of the affected system.
Affected Products
- GitPython versions prior to 3.1.50
- Python applications and CI/CD tooling embedding vulnerable GitPython releases
- Automation scripts that pass untrusted input to GitConfigParser.config_writer()
Discovery Timeline
- 2026-08-01 - CVE-2026-67326 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-67326
Vulnerability Analysis
GitPython exposes a config_writer() method on repository objects that returns a GitConfigParser instance for modifying Git configuration files. Callers supply a section argument identifying the target section, such as core or remote "origin". Before version 3.1.50, GitPython writes this section name into .git/config without stripping or rejecting newline characters. An attacker who controls the section string can embed \n sequences that terminate the intended section header and begin a new one.
The injected section can declare [core] with a hooksPath entry pointing to an attacker-writable directory containing executable hook scripts. Git honors core.hooksPath when executing lifecycle hooks such as post-checkout, pre-commit, or post-merge. Any later Git operation on the repository triggers the malicious hook, resulting in arbitrary command execution.
Root Cause
The root cause is missing input validation on the section parameter of config_writer(). The function trusts caller-supplied data and writes it verbatim to the configuration file. The Git configuration format is line-oriented, so unescaped newlines break out of the intended header and create an attacker-controlled section.
Attack Vector
Exploitation requires an application that forwards attacker-influenced data into config_writer(section=...). Common patterns include tools that derive section names from repository metadata, remote names, or user-submitted configuration. The attacker supplies a payload containing a newline followed by a forged [core] header and a hooksPath value referencing a directory they control. User interaction is required, typically in the form of a subsequent Git command that fires a hook. See the GitHub Security Advisory GHSA-mv93-w799-cj2w and the VulnCheck Advisory on GitPython for further technical detail.
Detection Methods for CVE-2026-67326
Indicators of Compromise
- Unexpected [core] sections in .git/config containing a hooksPath directive pointing outside the repository
- Duplicate or malformed section headers within .git/config indicating newline injection artifacts
- Executable files in non-standard hook directories referenced by core.hooksPath
- Child processes spawned by git binaries executing from user-writable or temporary directories
Detection Strategies
- Audit installed Python dependencies for GitPython versions below 3.1.50 using pip list or SBOM tooling
- Scan repositories on developer workstations and build agents for .git/config files containing hooksPath entries outside expected paths
- Review application source code for calls to config_writer() that accept untrusted input as the section argument
Monitoring Recommendations
- Alert on process executions where git spawns interpreters such as bash, python, or powershell from unusual paths
- Monitor file writes to .git/config across CI/CD runners and developer endpoints for unexpected section headers
- Log Git hook invocations in build pipelines and correlate against expected hook inventories
How to Mitigate CVE-2026-67326
Immediate Actions Required
- Upgrade GitPython to version 3.1.50 or later across all applications, virtual environments, and container images
- Inventory code paths that invoke config_writer() and ensure the section argument is never derived from untrusted input
- Inspect repositories handled by vulnerable GitPython versions for tampered .git/config files and rotate any secrets exposed to executed hooks
Patch Information
The maintainers addressed the issue in GitPython 3.1.50 by validating and rejecting newline characters in the section parameter of config_writer(). Refer to the GitHub Security Advisory GHSA-mv93-w799-cj2w for the fix commit and release notes.
Workarounds
- Enforce an allowlist of valid section names in application code before calling config_writer()
- Strip or reject \n, \r, and [/] characters from any section string passed to GitPython APIs
- Set GIT_CONFIG_NOSYSTEM=1 and disable core.hooksPath overrides in trusted execution contexts where feasible
- Run CI/CD Git operations under least-privilege service accounts to limit the blast radius of hook execution
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
