PyPI/gitpython CVE-2026-76221: high 8.8, EPSS 0.77%

GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

Action: Upgrade gitpython to 3.1.58 or later.

pip install gitpython==3.1.58

Affected

Fixed versions

Sources

• osv: GHSA-jm78-9fvv-mhgr
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr
• https://github.com/gitpython-developers/GitPython/pull/2204
• https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf
• https://github.com/gitpython-developers/GitPython
• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58

CVE-2026-76221 · published 2026-08-07T15:46:35Z · modified 2026-09-10T03:51:14.296736368Z · JSON