Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.59 fail to disable mergeincludes when parsing .gitmodules, enabling attackers to reveal local file contents by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file containing include directives referencing sensitiv...

GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

CWE: CWE-88 Argument Injection / CWE-94 Code Injection — via a read-then-corrupt-on-rewrite config round trip, not a direct setter argument - Affected component: git/config.py — GitConfigParser.read multi-line value decoding, lines 444-541, esp. stringdecode at line 460 and its call sites at...

GHSA-284H-M62Q-GF8W GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

CWE: CWE-88 Argument Injection / CWE-94 Code Injection — via a read-then-corrupt-on-rewrite config round trip, not a direct setter argument - Affected component: git/config.py — GitConfigParser.read multi-line value decoding, lines 444-541, esp. stringdecode at line 460 and its call sites at...

ROS-20260908-73-0094

The vulnerability of the GitConfigParser.read function in the git/config.py module of the Python library for interacting with Git repositories in GitPython is related to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to execute arbitra...

GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration

A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...

GitConfigParser Code Execution

The vulnerability of the GitConfigParser.read function in the git/config.py module of the Python library for interacting with Git repositories in GitPython is related to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to execute arbitra...

Duplicate Advisory: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-284h-m62q-gf8w. This link is maintained to preserve external references. Original Description GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting...

GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration

A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...

GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration

A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...