EUVD-2026-62462

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...

PT-2026-78403

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description A config-name injection issue exists in the option-name validator. This allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into optio...

CVE-2026-44244

A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...

GHSA-JM78-9FVV-MHGR GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

Summary GitPython's config-name validator only neutralizes CR/LF/NUL for the "option" label; it does not reject =, , ;, , , or whitespace in an option name. writesection writes the option name verbatim into the config file, so an option name such as sshCommand = touch is written as \tsshCommand =...

GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration

A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...

GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration

A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...

PYSEC-2026-2163

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.setvalue passes values to Python's configparser without validating for newlines. GitPython's own write converts embedded newlines into indented continuation lines e.g. \n becomes \n\t, b...

PYSEC-2026-2163

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.setvalue passes values to Python's configparser without validating for newlines. GitPython's own write converts embedded newlines into indented continuation lines e.g. \n becomes \n\t, b...

CVE-2026-44244

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.setvalue passes values to Python's configparser without validating for newlines. GitPython's own write converts embedded newlines into indented continuation lines e.g. \n becomes \n\t, b...

Remote Code Execution (RCE)

n8n is vulnerable to Remote Code Execution. The vulnerability is due to insufficient restriction of Git configuration values, where workflows using the Git node can set core.hooksPath to a malicious location, causing arbitrary commands to execute on the n8n host via crafted Git hooks during...

PT-2025-49610

Name of the Vulnerable Software and Affected Versions n8n versions 0.123.1 through 1.119.1 Description n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 lack sufficient protections against Remote Code Execution RCE through the project's pre-commit hooks. The Add...