CVE-2026-44244

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.

• CWE-94

• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49Patch, Release Notes
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67Exploit, Mitigation, Vendor Advisory
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67Exploit, Mitigation, Vendor Advisory

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44239FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.…8.8
• CVE-2026-4424A flaw was found in libarchive. This heap out-of-bounds read…7.5
• CVE-2026-44240basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basi…7.5
• CVE-2026-44241Micronaut Framework is a JVM-based full stack Java framework…7.5
• CVE-2026-44242Micronaut Framework is a JVM-based full stack Java framework…3.7
• CVE-2026-44243GitPython is a python library used to interact with Git repo…7.1
• CVE-2026-44245Kyverno is a policy engine designed for cloud native platfor…6.1
• CVE-2026-44246nnU-Net is a semantic segmentation framework that automatica…7.2
• CVE-2026-44247Volcano is a Kubernetes-native batch scheduling system. Prio…7.4
• CVE-2026-44248Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-44249Netty is a network application framework for development of …8.1
• CVE-2026-4425Rejected reason: Reserved for EastLink case, but no need for…