GitPython, a Python library for Git interactions, allows an attacker to inject newlines into configuration values via the set_value() function. The injected newlines are not properly validated by Python's configparser, leading to an unintended core.hooksPath entry. When Git executes hooks during operations such as commit or merge, scripts located at the attacker‑controlled path are run, giving full code‑execution capability. The weakness is a code‑injection flaw classified as CWE‑94 and carries a CVSS score of 7.8.

Any installation of GitPython earlier than version 3.1.49, distributed by the GitPython developers, is affected. The vulnerability is tied to the library’s configuration handling and applies to all environments that use GitPython to perform Git operations.

With a high CVSS score of 7.8, the vulnerability represents a serious threat. No EPSS value is available, making it unclear how frequently this is exploited, but the fact that the flaw leads to RCE means even a low exploitation probability can be unacceptable. The attack is most likely delivered by an attacker who has write access to a repository's configuration or can influence the creation of a GitPython‑based script. No conditional prerequisites beyond the use of GitPython are stated, and the flaw is not listed in the CISA KEV catalog at present.