CVE-2026-44244
High · 7.8CVSS
7.8
EPSS
0.2%
Published
May 7, 2026
CISA due date
—
The record
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-GitPython | 0 | 3.1.49-1.1 |
Related vulnerabilities
- CVE-2026-44243 GitPython is a python library used to interact with Git repositories. Also affects python-GitPython
- CVE-2026-42215 GitPython is a python library used to interact with Git repositories. Also affects python-GitPython
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-94
- CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-94
- CVE-2026-112095 A flaw has been found in SourceCodester Inventory System 1.0. CWE-94
- CVE-2026-112042 A security flaw has been discovered in diem-project diem up to… CWE-94
- CVE-2026-112038 A vulnerability has been found in diem-project diem up to… CWE-94