CVE-2026-76221 Overview
CVE-2026-76221 is a config-name injection vulnerability in GitPython versions before 3.1.58. The flaw resides in the option-name validator, which fails to reject equals signs, hash symbols, and whitespace inside git-config option names. Attackers with the ability to influence option names passed to GitPython can forge arbitrary git-config directives. This enables injection of malicious keys such as core.sshCommand or core.hooksPath, which Git executes on the next repository operation. The vulnerability is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
Critical Impact
Attackers can achieve arbitrary command execution on hosts running GitPython by injecting forged git-config directives through unvalidated option names.
Affected Products
- GitPython versions prior to 3.1.58
- Applications embedding GitPython for repository automation
- CI/CD pipelines using GitPython to manage cloned repositories
Discovery Timeline
- 2026-08-19 - CVE-2026-76221 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76221
Vulnerability Analysis
GitPython exposes wrapper methods that translate Python-level configuration calls into git config command invocations. The option-name validator restricts several characters but does not reject =, #, or whitespace. An attacker who controls an option-name string can append = value sequences and comment markers to forge additional configuration directives.
Git interprets specific configuration keys as executable directives. Setting core.sshCommand causes Git to invoke the supplied command during any network operation. Setting core.hooksPath redirects hook resolution to an attacker-controlled directory. Both provide reliable command execution paths on the next git fetch, git pull, or similar operation.
Root Cause
The root cause is insufficient input validation in the option-name path. The validator focuses on structural correctness but fails to treat =, #, and whitespace as separator characters that break configuration semantics. Because GitPython passes the resulting string directly into git-config directives, downstream Git parsing interprets the injected content as legitimate configuration.
Attack Vector
Exploitation requires an attacker to supply an option name to a GitPython API that reaches the vulnerable validator. A payload such as sshCommand = touch /tmp/RCE # injected as an option name produces a forged directive under core.sshCommand. On the next Git operation that uses SSH transport or hook execution, the injected command runs with the privileges of the process invoking GitPython. Refer to the GitHub Security Advisory and the VulnCheck Advisory on GitPython for full technical detail.
// Example exploitation code (sanitized)
No verified proof-of-concept code is available. See the linked advisories for exploitation detail.
Detection Methods for CVE-2026-76221
Indicators of Compromise
- Unexpected entries in repository .git/config files referencing core.sshCommand or core.hooksPath with shell payloads
- Presence of # comment markers or embedded = characters inside git-config option names in application logs
- Newly created files or processes spawned immediately after git fetch, git pull, or git clone operations
- Outbound connections originating from Git worker processes to unexpected destinations
Detection Strategies
- Inventory installed GitPython versions across build servers, developer workstations, and container images, flagging any release earlier than 3.1.58
- Instrument application code that calls GitPython option-setting APIs to log the raw option names and reject values containing =, #, or whitespace
- Monitor child processes spawned by Python interpreters running GitPython for shell invocations that do not match expected Git internals
Monitoring Recommendations
- Alert on modifications to .git/config files outside of controlled commit workflows
- Track process ancestry where git spawns interactive shells, curl, wget, or scripting interpreters
- Capture command-line arguments for all git config invocations and review for injected directives
How to Mitigate CVE-2026-76221
Immediate Actions Required
- Upgrade GitPython to version 3.1.58 or later across all environments that consume the library
- Audit application code that forwards user-controlled input into GitPython configuration APIs and add strict allow-list validation on option names
- Review historical .git/config files on shared build agents for previously injected core.sshCommand or core.hooksPath directives
Patch Information
Upgrade to GitPython 3.1.58 or later, which corrects the option-name validator to reject =, #, and whitespace characters. Rebuild and redeploy container images, virtual environments, and packaged applications that pin earlier releases. See the GitHub Security Advisory for the fixed commit reference.
Workarounds
- Restrict GitPython option-name inputs to a hardcoded allow-list of alphanumeric characters and dots before invocation
- Run Git operations under least-privileged service accounts that cannot access sensitive files or network destinations
- Disable SSH-transport Git operations for automation that does not require them, reducing the impact of forged core.sshCommand directives
# Configuration example
pip install --upgrade "GitPython>=3.1.58"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
