CVE-2026-44244: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

Vulnerability summary

CVE-2026-44244 is a high (CVSS 7.8) Improper Control of Generation of Code vulnerability in gitpython_project gitpython. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-05-2026
   PublishedVulnerability first disclosed.
2. 09-05-2026
   Last modifiedVulnerability information updated.

Description

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.

• CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.