GHSA-9557-234J-7RV9: gitpython PyPI
Vulnerability summary
GHSA-9557-234J-7RV9 is a critical (CVSS 9.3) vulnerability in gitpython PyPI.
Timeline
- 25-08-2026PublishedVulnerability first disclosed.
- 08-09-2026Last modifiedVulnerability information updated.
Description
Duplicate Advisory: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-284h-m62q-gf8w. This link is maintained to preserve external references. ## Original Description GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
PyPI1 product
- gitpython≤ 3.1.58
1 vendor · 1 product
