Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/05/06 9:58 p.m.16 views

GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

GitConfigParser.setvalue passes values to Python's configparser without validating for newlines. GitPython's own write converts embedded newlines into indented continuation lines e.g. \n becomes \n\t, but Git still accepts an indented core stanza as a section header — so the injected core.hooksPa...

7.8CVSS6AI score0.00237EPSS
SaveExploits1References4Affected Software1
Rows per page
Query Builder