# CVE-2026-44244: gitpython — Fixed in 3.1.49 🐍 🐍 PyPI Not in CISA KEV HIGH severity # CVE-2026-44244 — gitpython HIGH CVE-2026-44244 is a high-severity (CVSS 7.8) Code Injection vulnerability in gitpython. A fix is available for gitpython — see the affected versions and patch details below. GitPython: Newline injection in config\_writer().set\_value() enables RCE via core.hooksPath Also known as[GHSA-v87r-6q3f-2j67](/vulnerability/GHSA-v87r-6q3f-2j67)PYSEC-2026-2163 Published May 7, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. - A successful exploit gives an attacker total control of the affected component, not partial access. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-44244. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.2%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs15th percentile — riskier than 15% of all scored CVEsHighest risk 0.00%0.25%0.49%0.74%0.0%0.2%Jun 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🐍`gitpython` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems. ## Description `GitConfigParser.set_value()` passes values to Python's `configparser` without validating for newlines. GitPython's own `_write()` converts embedded newlines into indented continuation lines (e.g. `\n` becomes `\n\t`), but Git still accepts an indented `[core]` stanza as a section header — so the injected `core.hooksPath` becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. The vulnerability is not merely malformed config output: GitPython's own writer converts embedded newlines into indented continuation lines, but Git still accepts an indented `[core]` stanza as a section header, so the injected `core.hooksPath` becomes effective configuration. This was found while auditing MLRun's `project.push()` method, which passes `author_name` and `author_email` directly to `config_writer().set_value()` with no sanitization. Both parameters cross a trust boundary — they are caller-supplied API inputs that end up in `.git/config`. PoC (standalone, no MLRun required): ``` import git, subprocess, os repo = git.Repo("/tmp/testrepo") with repo.config_writer() as cw: cw.set_value("user", "name", "foo\n[core]\nhooksPath=/tmp/hooks") r = subprocess.run(["git", "config", "core.hooksPath"], cwd="/tmp/testrepo", capture_output=True, text=True) assert r.returncode == 0 print(r.stdout.strip()) # /tmp/hooks os.makedirs("/tmp/hooks", exist_ok=True) open("/tmp/hooks/pre-commit", "w").write("#!/bin/sh\nid > /tmp/pwned\n") os.chmod("/tmp/hooks/pre-commit", 0o755) repo.index.add(["README"]) repo.git.commit(m="test") print(open("/tmp/pwned").read()) # uid=... ``` Tested on GitPython 3.1.46, git 2.39+. Impact: This is persistent repo config poisoning. Any user who can supply `author_name` or `author_email` to an application calling `config_writer().set_value()` can redirect Git hook execution to an arbitrary path. In a multi-user or hosted environment (e.g. a shared MLRun server where multiple users push to the same repositories), one user can poison the `.git/config` of a shared repo and have their hooks run in the context of every subsequent Git operation by any user. On single-user deployments, the impact depends on whether the application later invokes Git hooks automatically. Remediation: `set_value()` should raise on CR, LF, or NUL in values rather than silently pass them through: ``` import re if isinstance(value, (str, bytes)) and re.search(r"[\r\n\x00]", str(value)): raise ValueError("Git config values must not contain CR, LF, or NUL") ``` Rejecting is safer than stripping — a stripped newline might indicate the caller is passing unsanitized input at a higher level, and silent normalization masks that. Affected wherever `config_writer().set_value(section, key, user_input)` is called with external input.\*\* GitPython is a dependency of DVC, MLflow, Kedro, and others — worth auditing their `set_value()` call sites for externally influenced inputs. ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 🐍PyPI `gitpython` all versions 3.1.49`pip install --upgrade 'gitpython==3.1.49'` ## Affected Products 1 product · 1 configurations Application `gitpython`gitpython\_project < 3.1.49 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for gitpython, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update gitpython to 3.1.49 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-44244 is resolved across your whole dependency graph. 3. ### Workarounds Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does. ## Fixing This On Your OS If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project. Red HatImportant This is an Important flaw in GitPython that allows for arbitrary code execution. By injecting newlines into Git configuration values, an attacker can manipulate the \`core.hooksPath\` to execute malicious scripts during standard Git operations. This poses a significant risk in environments where applications process… Workaround published by Red Hat > To mitigate this issue, applications that use GitPython and process untrusted input for Git configuration values must implement robust input validation and sanitization. This prevents the injection of newlines that could manipulate \`core.hooksPath\` and lead to arbitrary code execution. Additionally, ensure that applications interacting with Git repositories operate with the principle of least privilege to limit the potential impact of any successful exploitation. Source: [Red Hat security advisory for CVE-2026-44244](https://access.redhat.com/security/cve/cve-2026-44244) (CC BY 4.0) Product Fixed in Advisory Red Hat Ansible Automation Platform 2.5 for RHEL 8 `python3.12-gitpython-0:3.1.50-1.el8ap` [RHSA-2026:42078](https://access.redhat.com/errata/RHSA-2026:42078) Red Hat Ansible Automation Platform 2.6 for RHEL 9 `python3.12-gitpython-0:3.1.50-1.el9ap` [RHSA-2026:42079](https://access.redhat.com/errata/RHSA-2026:42079) Red Hat Satellite 6.19 for RHEL 9 `python3.12-gitpython-0:3.1.59-1.el9pc` [RHSA-2026:63385](https://access.redhat.com/errata/RHSA-2026:63385) Red Hat Ansible Automation Platform 2.5 `ansible-automation-platform-25/controller-rhel8:1789607021` [RHSA-2026:71210](https://access.redhat.com/errata/RHSA-2026:71210) Red Hat Ansible Automation Platform 2.6 `ansible-automation-platform-26/hub-rhel9:1783979593` [RHSA-2026:42132](https://access.redhat.com/errata/RHSA-2026:42132) Red Hat Ansible Automation Platform 2.6 `ansible-automation-platform-26/controller-rhel9:1789673739` [RHSA-2026:71179](https://access.redhat.com/errata/RHSA-2026:71179) Red Hat Ansible Automation Platform 2.7 `ansible-automation-platform-27/controller-rhel9:1787220257` [RHSA-2026:59153](https://access.redhat.com/errata/RHSA-2026:59153) Red Hat Ansible Automation Platform 2.7 `ansible-automation-platform-27/hub-rhel9:1788918708` [RHSA-2026:67279](https://access.redhat.com/errata/RHSA-2026:67279) ## Frequently Asked Questions \`GitConfigParser.set\_value()\` passes values to Python's \`configparser\` without validating for newlines. GitPython's own \`\_write()\` converts embedded newlines into indented continuation lines (e.g. \`\\n\` becomes \`\\n\\t\`), but Git still accepts an indented \`\[core\]\` stanza as a section header — so the injected \`core.hooksPath\` becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. The vulnerability is not merely malformed config output: GitPython's own writer converts embedded newlines into indent O3 Security · Impact-Aware SCA ### Is CVE-2026-44244 in your dependencies? Find it across PyPI, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)