CVE-2026-67326

GitPython prior to 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing an attacker to inject arbitrary section headers into .git/config. Attackers can inject newlines to forge a [core] section with hooksPath pointing to attacker-controlled directories...