CVE-2026-76221: gitpython_project gitpython Injection

Vulnerability summary

CVE-2026-76221 is a high (CVSS 8.8) Injection vulnerability in gitpython_project gitpython. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 54.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-08-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.