Read the docs
TI-2026-53326 Aliases CVE-2026-76221GHSA-78pq-g4m8-fx2c

GitPython before 3.1.58 Config Injection via option-name

Priority MEDIUM 40CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 6 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00485 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial GitPython (gitpython-developers): 3.1.58Red Hat: 9 advisoriesRed Hat: 6 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gitpython-developersGitPythonbefore 3.1.583.1.58Patch availableCNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*before 3.1.58Vulnerablegitpython-developers
  • cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* Versions before 3.1.58 Vulnerable ·gitpython-developers

Remediation

  • Fix · CNA GitPython (gitpython-developers) Fixed in 3.1.58

Red Hat 9 advisories

  • RHSA-2026:79378 Released 2026-10-08 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/gateway-rhel9 +4
  • RHSA-2026:71210 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8 +4
  • RHSA-2026:71179 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
Show 6 more Red Hat advisories
  • RHSA-2026:71177 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9 +4
  • RHSA-2026:68780 Released 2026-09-17 · Red Hat rating Critical
    Technical preview of the satellite/iop-vmaas-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9
  • RHSA-2026:68776 Released 2026-09-17 · Red Hat rating Critical
    satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
  • RHSA-2026:68771 Released 2026-09-17 · Red Hat rating Critical
    satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
  • RHSA-2026:68764 Released 2026-09-17 · Red Hat rating Critical
    Technical preview of the satellite/iop-vmaas-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vmaas-rhel9
  • RHSA-2026:63385 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.19.4 Async Update
    • Red Hat Satellite 6.19 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    gitpython-developers GitPython 3.1.58

    6 records Highest priority Priority HIGH 1 HIGH, 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-53327 GitPython before 3.1.58 Path Traversal via .gitmodules Submodule NamePriority HIGH 70
    • TI-2026-53322 GitPython before 3.1.58 Arbitrary File Read via pathspec-from-filePriority MEDIUM 64
    • TI-2026-53325 GitPython before 3.1.58 Command Execution via split_single_char_optionsPriority MEDIUM 40
    Show all 6 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:71210
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:71179
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:71177, RHSA-2026:79378
Red Hat Satellite 6.18Fixed RHSA-2026:68764, RHSA-2026:68771
Red Hat Satellite 6.19Fixed RHSA-2026:68776, RHSA-2026:68780
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:63385
Not affected: 14 products
  • Exploit Intelligence
  • Migration Toolkit for Applications 8
  • Pen Drive Powered by Red Hat Lightspeed
  • Red Hat AI Inference Server
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat Satellite 6.19 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76221
  2. 2026-10-03 Alias added: GHSA-78pq-g4m8-fx2c
  3. 2026-10-09 Fix available: RHSA-2026:79378 · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-31 EPSS moved to the below the 50th percentile
  6. 2026-11-06 Fix available: RHSA-2026:71177 · Red Hat

References

Exploit 1

  • TI-2026-54689 GitPython before 3.1.59 Path Traversal via separate-git-dir CVSS 4.0HIGH 8.7
  • TI-2026-51706 GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() CVSS 4.0HIGH 8.7
  • TI-2026-47618 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from CVSS 4.0HIGH 8.7
  • TI-2026-30595 GitPython: Unsafe option check validates multi_options before shlex.split transforms it CVSS 3.1CRITICAL 9.8
  • TI-2026-32220 GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository CVSS 4.0HIGH 7.8
  • TI-2026-47621 GitPython before 3.1.51 Command Injection via option prefix abbreviation CVSS 4.0HIGH 8.7
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences