CVE-2026-76221
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Aug 19, 2026
Vendor
unknown
Description
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.