CVE-2025-65964

n8n Git Hooks CTF デモ ⚠️ このリポジトリは教育およびCTFデモンストレーション目的のみ です。 シナリオ 自動化プラットフォーム（例：n8n）はワークフローの一部としてGit操作を使用します。 ワークフローはgit configを介して任意のGit設定を許可します。 攻撃者が制御するワークフローは以下を設定します： root@kitploit: core.hooksPath=hooks/ Gitはその後、リポジトリディレクトリからフックを実行します。 目的 以下を実証する： Gitフックがローカルで実行されること フックがクローンされたリポジトリ内に存在できること...

EUVD-2026-65222

GitPython: Dormant multi-line git-config values are corrupted into live injected directives e.g. core.hooksPath on any unrelated GitConfigParser write, enabling RCE...

GitPython: GitPython: Arbitrary code execution via improper validation of clone options

A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the clone function. By crafting a malicious string in the multioptions parameter, an attacker could bypass validation. This allows for the...

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-19590

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlle...

EUVD-2026-69393

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlle...

CVE-2026-19590

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlle...

PT-2026-84354

Name of the Vulnerable Software and Affected Versions OpenAI Codex Desktop for Windows and macOS affected versions not specified Description OpenAI Codex Desktop can execute attacker-controlled Git hooks due to automated Git operations trusting the repository local core.hooksPath setting. If a us...

CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

EUVD-2026-62462

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...

CVE-2026-44244

A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...

GHSA-JM78-9FVV-MHGR GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

Summary GitPython's config-name validator only neutralizes CR/LF/NUL for the "option" label; it does not reject =, , ;, , , or whitespace in an option name. writesection writes the option name verbatim into the config file, so an option name such as sshCommand = touch is written as \tsshCommand =...

PT-2026-78403

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description A config-name injection issue exists in the option-name validator. This allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into optio...

GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration

A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...

GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration

A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...

PYSEC-2026-2163

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.setvalue passes values to Python's configparser without validating for newlines. GitPython's own write converts embedded newlines into indented continuation lines e.g. \n becomes \n\t, b...

PYSEC-2026-2163

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.setvalue passes values to Python's configparser without validating for newlines. GitPython's own write converts embedded newlines into indented continuation lines e.g. \n becomes \n\t, b...

CVE-2026-44244

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.setvalue passes values to Python's configparser without validating for newlines. GitPython's own write converts embedded newlines into indented continuation lines e.g. \n becomes \n\t, b...