CVE-2026-76221

The record

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.

Affected packages

Related vulnerabilities

• CVE-2026-47256 OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability… CWE-74
• CVE-2026-69097 GitPython before 3.1.53 fails to properly escape section names in git config files… CWE-74
• CVE-2026-16729 undici's setCookie function does not fully sanitize cookie attributes. CWE-74
• CVE-2026-57522 Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in… CWE-74
• CVE-2026-0864 When using the "configparser" module to write configuration files containing multi-line… CWE-74
• CVE-2026-50574 yt-dlp is a command-line audio/video downloader. CWE-74
• CVE-2026-12888 An HTML injection vulnerability exists in the Google Chat webhook notification sent by… CWE-74
• CVE-2026-12822 A vulnerability was identified in langflow-ai langflow up to 1.9.3. CWE-74