GHSA-jm78-9fvv-mhgr is a high-severity (CVSS 8.8) CWE-74 vulnerability in gitpython. A fix is available for gitpython — see the affected versions and patch details below.
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-jm78-9fvv-mhgr.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-jm78-9fvv-mhgr plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,636 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
gitpythonReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
GitPython's config-name validator only neutralizes CR/LF/NUL for the "option" label; it does not reject =, #, ;, [, ], or whitespace in an option name. write_section writes the option name verbatim into the config file, so an option name such as sshCommand = touch <cmd> # is written as \tsshCommand = touch <cmd> # = <value>, which git parses as core.sshCommand = touch <cmd> (the trailing # comments out the intended value). This forges arbitrary config directives (core.sshCommand, core.hooksPath, alias.*) → RCE on the next git operation. This is a distinct field (option name, not section name) and distinct character class (=/#/space, not newline/bracket) from GHSA-3rp5-jjmw-4wv2 (section-name bracket injection) and GHSA-mv93-w799-cj2w / GHSA-v87r-6q3f-2j67 (newline injection).
Root Cause
_assure_config_name_safe(name, label) (git/config.py:897) applies the bracket/quote state machine ONLY when label == "section"; for the "option" label it falls through with just the UNSAFE_CONFIG_CHARS_RE = [\r\n\x00] regex. write_section then writes the option name verbatim into "\t%s = %s\n" (config.py:702).
Impact
Arbitrary git-config directive injection → remote code execution via core.sshCommand (fires on any ssh git operation, no staged file needed) or core.hooksPath (with a staged hook). Requires the embedding application to forward a caller-influenced OPTION NAME into the config writer (name-control model, the same name-control model accepted by the related published advisories GHSA-3rp5-jjmw-4wv2 and GHSA-mv93-w799-cj2w). Default configuration.
Proof of Concept
with repo.config_writer() as cw:
cw.set_value("core", "sshCommand = touch /tmp/RCE #", "x")
# git config --get core.sshCommand -> touch /tmp/RCE
Attack Chain
- Entry: app calls config writer with attacker-controlled OPTION name:
set_value("core", "sshCommand = touch /tmp/RCE #", "x"). - Check:
_assure_config_name_safe(option, "option")@ config.py. Guard: regex matches only[\r\n\x00]; bracket/quote state machine is gated onlabel=="section". Bypass proof:=,#,space pass → noValueError. - Sink:
write_sectionwrites"\tsshCommand = touch /tmp/RCE # = x\n"(config.py:702). - Impact: git parses
core.sshCommand=touch /tmp/RCE→ arbitrary code execution on next git op.
Bypass Evidence
Independently reproduced (gate harness): set_value('core','sshCommand = touch <RCE> #','x') → no ValueError; file line sshCommand = touch <RCE> # = x; git config --get core.sshCommand → touch <RCE> (rc=0). Also verified core.hooksPath via both GitConfigParser and repo.config_writer(). Fix-commit read: bracket/quote checks are inside if label == "section"; the "option" label is not covered.
Affected Versions
GitPython <= 3.1.57 (validator present verbatim on the latest release tag).
Suggested Fix
Apply the section-name safety checks (reject =, #, ;, [, ], whitespace) to the "option" label as well, or validate the fully-rendered config line after substitution.
Reported by zx (Jace) — GitHub: @manus-use
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | gitpython | all versions | 3.1.58pip install --upgrade 'gitpython==3.1.58' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for gitpython, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update gitpython to 3.1.58 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-jm78-9fvv-mhgr is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-jm78-9fvv-mhgr can be triaged on real exposure rather than presence alone.
Tailored to GHSA-jm78-9fvv-mhgr. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
GitPython's option-name validator fails to neutralize equals signs, hash symbols, and whitespace in option names, letting an attacker who controls option names forge arbitrary git-config directives (e.g. `sshCommand = touch /tmp/RCE #`) that execute arbitrary commands via core.sshCommand or core.hooksPath on the next…
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Satellite 6.19 for RHEL 9 | python3.12-gitpython-0:3.1.59-1.el9pc | RHSA-2026:63385 |
| Red Hat Satellite 6.18 | satellite/iop-vmaas-rhel9:1789611858 | RHSA-2026:68764 |
| Red Hat Satellite 6.18 | satellite/iop-vulnerability-engine-rhel9:1789637082 | RHSA-2026:68771 |
| Red Hat Satellite 6.19 | satellite/iop-vulnerability-engine-rhel9:1789607605 | RHSA-2026:68776 |
| Red Hat Satellite 6.19 | satellite/iop-vmaas-rhel9:1789611998 | RHSA-2026:68780 |
Frequently Asked Questions
Is GHSA-jm78-9fvv-mhgr in your dependencies?
O3 Security finds GHSA-jm78-9fvv-mhgr across PyPI dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.