GitPython versions earlier than 3.1.58 contain a config-name injection flaw that allows an attacker to craft malicious option names containing equals signs, hash symbols, or whitespace. By inserting malicious option names such as 'sshCommand = touch /tmp/RCE #' the attacker can cause git operations to execute arbitrary commands through the core.sshCommand or core.hooksPath directives. This results in complete compromise of the host when a git command is run, exposing the system to full remote code execution.

The vulnerability affects the GitPython library, maintained by the gitpython-developers. Any installation running a version older than 3.1.58 is susceptible; this includes all environments that embed GitPython, such as Python applications that use GitPython for repository management or automated deployment scripts.

The CVSS score of 8.7 classifies this as a high‑severity flaw. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating the public exploitation risk is currently unknown. However, the flaw requires the attacker to supply a crafted git‑config entry, making local or privileged access the most likely attack vector. If an attacker can influence configuration files or environment variables, remote command execution can be achieved with little to no user interaction on the target.