This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-76221 →

DEBIAN-CVE-2026-76221

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-confi...

Original description

The description as published by the source.

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.61-1"}]}]

References

advisory security-tracker.debian.org