GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
Priority HIGH 69CWE-94Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 11 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.
Summary
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00237 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial GitPython (gitpython-developers): 3.1.49GitPython (PyPI): 3.1.49Red Hat: 14 advisoriesRed Hat: 11 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gitpython-developers | GitPython | before 3.1.49 | 3.1.49 | Patch available | CNA |
| — | GitPython (PyPI) | before 3.1.49 | 3.1.49 | Patch available | GHSA-v87r-6q3f-2j67 |
- GitPython Vendorgitpython-developers Affected before 3.1.49 Fixed in 3.1.49 Patch available CNA
- GitPython (PyPI) Vendor— Affected before 3.1.49 Fixed in 3.1.49 Patch available GHSA-v87r-6q3f-2j67
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* | before 3.1.49 | Vulnerable | gitpython-developers |
- cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* Versions before 3.1.49 Vulnerable ·gitpython-developers
Remediation
- Fix · CNA GitPython (gitpython-developers) Fixed in 3.1.49
- Fix · GHSA-v87r-6q3f-2j67 GitPython (PyPI) Fixed in 3.1.49 Advisory →
Red Hat 14 advisories
- RHSA-2026:71210 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8 +4
- RHSA-2026:71179 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
- RHSA-2026:68780 Released 2026-09-17 · Red Hat rating CriticalTechnical preview of the satellite/iop-vmaas-rhel9 container image
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9
Show 11 more Red Hat advisories
- RHSA-2026:68776 Released 2026-09-17 · Red Hat rating Criticalsatellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
- RHSA-2026:68771 Released 2026-09-17 · Red Hat rating Criticalsatellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
- RHSA-2026:68764 Released 2026-09-17 · Red Hat rating CriticalTechnical preview of the satellite/iop-vmaas-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vmaas-rhel9
- RHSA-2026:67279 Released 2026-09-14 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +7
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:63385 Released 2026-09-03 · Red Hat rating ImportantSatellite 6.19.4 Async Update
- Red Hat Satellite 6.19 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:59153 Released 2026-08-24 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +3
- RHSA-2026:42132 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
- RHSA-2026:42079 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 ansible-core-2:2.16.19-1.el10ap, receptor-1.6.6-1.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, automation-controller-venv-tower-4.7.14-3.el9ap, automation-gateway-proxy-2.6.17-1.el9ap +5
- RHSA-2026:42078 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.19-1.el8ap, ansible-test-1:2.16.19-1.el8ap, automation-controller-4.6.30-2.el8ap +24
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, ansible-test-1:2.16.19-1.el9ap, automation-controller-4.6.30-2.el9ap +24
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| Pen Drive Powered by Red Hat Lightspeed | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.5 | Fixed | RHSA-2026:71210 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:42132, RHSA-2026:71179 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:42079 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:59153, RHSA-2026:67279 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:68764, RHSA-2026:68771 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:68776, RHSA-2026:68780 |
| Red Hat Satellite 6.19 for RHEL 9 | Fixed | RHSA-2026:63385 |
Not affected: 24 products
- Migration Toolkit for Applications 8
- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Ansible Automation Platform 2.7
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat Satellite 6.19 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44244
- 2026-10-03 Alias added: GHSA-v87r-6q3f-2j67
References
More gitpython-developers Gitpython vulnerabilities
- TI-2026-54689 GitPython before 3.1.59 Path Traversal via separate-git-dir CVSS 4.0HIGH 8.7
- TI-2026-51706 GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() CVSS 4.0HIGH 8.7
- TI-2026-47618 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from CVSS 4.0HIGH 8.7
- TI-2026-30595 GitPython: Unsafe option check validates multi_options before shlex.split transforms it CVSS 3.1CRITICAL 9.8
- TI-2026-32220 GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository CVSS 4.0HIGH 7.8
- TI-2026-47621 GitPython before 3.1.51 Command Injection via option prefix abbreviation CVSS 4.0HIGH 8.7
Sources
- CVE-2026-44244 · CVE Program
- CVE-2026-44244 · NVD
- FIRST EPSS
- GHSA-v87r-6q3f-2j67 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-44244 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences