CVE-2026-78676: falha crítica em gitpython-developers GitPython
GitPython before 3.1.59 Remote Code Execution via Config Injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.6%
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
gitpython-developers · GitPythonCVEs relacionadas — gitpython-developers GitPython
No mesmo produto, das mais perigosas para as menos.
CVE-2026-67325HIGHGitPython before 3.1.51 Command Injection via option prefix abbreviationEPSS 2.2%CVE-2026-67323HIGHGitPython before 3.1.51 Command Injection via unguarded Git optionsEPSS 1.3%CVE-2023-41040MEDIUMGitPython blind local file inclusionEPSS 1.1%CVE-2026-73623HIGHGitPython before 3.1.54 Remote Code Execution via --templateEPSS 1.0%CVE-2026-42215HIGHGitPython: Command injection via Git options bypassEPSS 0.7%CVE-2026-76218HIGHGitPython before 3.1.58 Remote Code Execution via Repo.initEPSS 0.7%