CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.59 are vulnerable to a critical flaw that allows attackers to inject malicious directives into git-config files by exploiting improper handling of multi-line values. This vulnerability can lead to arbitrary code execution through the invocation of crafted hooks during GitPython write operations. Organizations using GitPython should prioritize updating to the latest version to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)