The vulnerability is a newline injection in GitPython’s config_writer() function. The library does not sanitize the section parameter, allowing attackers to embed newline characters. By inserting newlines, a malicious user can forge a new section header in the repository’s .git/config file, such as a core section whose hooksPath points to an attacker‑controlled directory. When Git subsequently executes hooks from that directory, it runs attacker‑supplied scripts, giving remote code execution.

All installations of GitPython version 3.1.49 and earlier. The affected product is the open‑source GitPython library maintained by the gitpython‑developers on the Python Package Index, commonly used in Python applications that interact with Git repositories.

The CVSS score of 7.3 indicates high severity and the lack of an EPSS score prevents a precise exploitation likelihood estimate. The vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation. Attackers must be able to invoke config_writer with a malicious section string, which generally requires code execution or supply of crafted data within a Python application. Once a forged hooksPath is in place, the risk escalates to full remote code execution whenever Git triggers hooks.