{"action":"Upgrade gitpython to 3.1.58 or later.","affected":[{"fixed":"3.1.58","introduced":"0"}],"component":"gitpython","cve_ids":["CVE-2026-76221"],"ecosystem":"PyPI","epss":0.00774,"exploited":false,"fixed_versions":["3.1.58"],"ghsa_id":"GHSA-jm78-9fvv-mhgr","id":"tcs_01M5KFP7HA632VM70C4K539G21","modified_at":"2026-09-10T03:51:14.296736368Z","published_at":"2026-08-07T15:46:35Z","references":["https://osv.dev/vulnerability/GHSA-jm78-9fvv-mhgr","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr","https://github.com/gitpython-developers/GitPython/pull/2204","https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf","https://github.com/gitpython-developers/GitPython","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-jm78-9fvv-mhgr","url":"https://osv.dev/vulnerability/GHSA-jm78-9fvv-mhgr"}],"summary":"GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)"}