CVE-2026-44244
Description
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.
How to fix
- gitpython_project gitpython3.1.49 or later
- gitpython3.1.49 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitpython_project gitpython | v < 3.1.49 | 3.1.49 |
| gitpythonPyPI | v < 3.1.49 | 3.1.49 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.