---
schema_version: '1.0'
id: security-20260714-6a196b
url: https://osv.dev/vulnerability/PYSEC-2026-2163
url_hash: 6a196b9beb26f594ee14cbc6c02835837fc77b5cbfdc8da22de955889ef232c0
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2163
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-44244
- PYSEC-2026-2163
- severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- gitpython
- PyPI
lang: en
published_at: '2026-05-07T19:16:02Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:43:41Z'
status: published
content_hash: c8451b34a9be7e03f4738a79d3802c8baedb1106afa0f46981761f72cc450f67
license_note: full
summary: 'GitPython is a python library used to interact with Git repositories. Prior
  to version 3.1.49, GitConfigParser.set_value() passes values to Python''s configparser
  without validating for newlines. GitPython''s own _write() converts embedded newlines
  into indented continuation lines '
summary_source: rss
summary_en: 'GitPython is a python library used to interact with Git repositories.
  Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python''s
  configparser without validating for newlines. GitPython''s own _write() converts
  embedded newlines into indented continuation lines '
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-44244 — gitpython
---

# CVE-2026-44244 — gitpython

## TL;DR
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines 

## Key Points
- cve / CVE-2026-44244 / PYSEC-2026-2163 / severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H / gitpython / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
**Advisory:** PYSEC-2026-2163 (CVE-2026-44244)

**Affected (your watchlist):**
- `PyPI:gitpython` 3.1.46 → fixed in 3.1.49 [docker/docker-llmwiki]

**Details:**
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.

**References:**
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2163_

## Source
元記事: [CVE-2026-44244 — gitpython](https://osv.dev/vulnerability/PYSEC-2026-2163) — published 2026-05-07T19:16:02Z