THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-67326 (HIGH 7.0) — GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-c

[NVD] CVE-2026-67326 (HIGH 7.0) — GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-c

mednvdPublished 2026-08-01

CVE-2026-67326 CVSS: 7.0 HIGH Published: 2026-08-01T13:17:03.063

GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution

Indicators of compromise

CVE-2026-67326cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-67326