GitPython versions prior to 3.1.59 contain a flaw that fails to safely re‑serialize multi‑line git‑config values during write operations, corrupting dormant quoted values into injected directives such as core.hooksPath. When an attacker crafts a config file with embedded newlines, those newlines become live git directives after any unrelated GitPython config write, allowing arbitrary code execution by invoking a hook.

The affected product is GitPython, any installation of the gitpython‑developers library with a version older than 3.1.59. Upgrading to 3.1.59 or later removes the vulnerability.

The CVSS score of 9.3 indicates a high severity impact. EPSS is not reported, and the vulnerability is not yet listed in CISA KEV. The likely attack vector is a local attacker or one with write access to a repository’s configuration, who can inject malicious directives that are subsequently executed when GitPython writes any config entry. While the description does not state the exploitation requires network access, the local nature of config modification suggests that compromise or privilege escalation may be required to execute the payload.