CVE catalog

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can

[CVE catalog]

Severity: Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Aug 25, 2026, 1:30:33 AM UTC
Updated: Aug 25, 2026, 2:16:52 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.78% · Oct 25, 2026

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	python-git	sid	`3.2.1-1`	fixed
Debian	python-git	forky	`3.2.1-1`	fixed
Debian	python-git	trixie	`3.1.44-1`	vulnerable
Debian	python-git	bookworm	`3.1.30-1+deb12u2`	vulnerable
Cpe	gitpython	Not reported	`3.1.59`	fixed
PyPI	gitpython	Not reported	`3.1.59`	fixed
Pip	GitPython	Not reported	`3.1.59`	fixed
Opensuse	python-GitPython	tumbleweed	`3.1.59-3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	python-git	source	sid	`3.1.61-1`	not yet assigned	Not reported	[1145672]
Debian	python-git	source	forky	`3.1.61-1`	not yet assigned	Not reported	[1145672]
Debian	python-git	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1145672]
Debian	python-git	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1145672]
Cpe	gitpython	cpe	Not reported	`3.1.59`	Not reported	NVD-CVE-2026-78676	Not reported
PyPI	gitpython	PyPI	Not reported	`3.1.59`	Not reported	PYSEC-2026-3786	Not reported
Pip	GitPython	pip	Not reported	`3.1.59`	Not reported	GHSA-284H-M62Q-GF8W	Not reported
Opensuse	python-GitPython	rpm	tumbleweed	`3.1.59-3.1`	Not reported	OPENSUSE-SU-2026:11615-1	Not reported

[Debian bug #1145672]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[python3-git]Affected
Source package: [python-git]
Details (2)
- 3.1.30-1+deb12u2 · all · bookworm
  Affected
  nvd · python-git · debian · bookworm; nvd · python-git · debian · 12
- 3.1.30-1+deb12u2 · all · bookworm
  Affected
  nvd · python-git · debian · bookworm; nvd · python-git · debian · 12
[python-git-doc]Affected
Source package: [python-git]
Details (2)
- 3.1.30-1+deb12u2 · all · bookworm
  Affected
  nvd · python-git · debian · bookworm; nvd · python-git · debian · 12
- 3.1.30-1+deb12u2 · all · bookworm
  Affected
  nvd · python-git · debian · bookworm; nvd · python-git · debian · 12

[Debian 13 (Trixie)]

[python3-git]Affected
Source package: [python-git]
Details (2)
- 3.1.44-1 · all · trixie
  Affected
  nvd · python-git · debian · 13
- 3.1.44-1 · all · trixie
  Affected
  nvd · python-git · debian · 13
[python-git-doc]Affected
Source package: [python-git]
Details (2)
- 3.1.44-1 · all · trixie
  Affected
  nvd · python-git · debian · 13
- 3.1.44-1 · all · trixie
  Affected
  nvd · python-git · debian · 13

[openSUSE Tumbleweed]

[python313-GitPython]Unknown
Source package: [python-GitPython]
Details (1)
- 3.1.61-1.1 · noarch · tumbleweed
  Unknown · Fixed: 3.1.59-3.1
  Version impact unknown
  nvd · python-GitPython · opensuse · tumbleweed
[python314-GitPython]Unknown
Source package: [python-GitPython]
Details (1)
- 3.1.61-1.1 · noarch · tumbleweed
  Unknown · Fixed: 3.1.59-3.1
  Version impact unknown
  nvd · python-GitPython · opensuse · tumbleweed

Observed: Oct 23, 2026, 9:37:02 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]