Technical impact
The vulnerability is a newline injection in GitPython’s config_writer() function. The library does not sanitize the section parameter, allowing attackers to embed newline characters. By inserting newlines, a malicious user can forge a new section header in the repository’s .git/config file, such as a core section whose hooksPath points to an attacker‑controlled directory. When Git subsequently executes hooks from that directory, it runs attacker‑supplied scripts, giving remote code execution.
Affected Systems
All installations of GitPython version 3.1.49 and earlier. The affected product is the open‑source GitPython library maintained by the gitpython‑developers on the Python Package Index, commonly used in Python applications that interact with Git repositories.
Risk and Exploitability
The CVSS score of 7.3 indicates high severity. The EPSS score of 0.00191 (about 0.19%) shows a very low but non‑zero probability of exploitation, which aligns with the not‑listed-in KEV status. The vulnerability is remote‑code‑execution‑capable after a forged hooksPath is set, and attack requires the ability to call config_writer() with a malicious section string, which typically requires execution or the ability to inject crafted data into a related Python application.
Debian DLA