CVE-2026-67326

Katalog CVE

CVSS 7.8 · High EPSS 0,25%

Kerentanan Improper Input Validation pada gitpython project gitpython. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.

Rincian

Terbit di NVD

1 Agustus 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w exploit · advisory vendor
• https://www.vulncheck.com/advisories/gitpython-before-newline-injection-via-config-writer-section advisory pihak ketiga