CVE-2026-67326: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-67326 is a newline injection vulnerability in GitPython's config_writer() function that allows attackers to inject arbitrary section headers into .git/config, ultimately enabling remote code execution (RCE) via malicious git hooks. It affects all GitPython versions before 3.1.50 and represents an incomplete fix bypass of the earlier CVE-2026-42215 patch (which only validated the value parameter, leaving section and option unvalidated). The vulnerability was published on August 1, 2026, with a patch available in GitPython 3.1.50. It carries a CVSS v3.1 score of 7.0 (High) and a CVSS v4.0 score of 7.3 (High) (GitHub Advisory, GitPython Advisory).

The root cause is improper input validation (CWE-20) in git/config.py: the set_value() method validates newline characters only in the value parameter (as patched in CVE-2026-42215), but passes section and option directly to Python's configparser without any newline sanitization. The _write() method formats section headers as "[%s]\n" % name, so when an attacker supplies a section argument such as "user]\n[core", the resulting output writes two valid INI section headers — [user] and [core] — into .git/config. This allows the attacker to forge a [core] section with hooksPath pointing to an attacker-controlled directory, so that any subsequent git hook trigger (e.g., a pre-commit hook on git commit) executes arbitrary code. A public proof-of-concept is included in the security advisory (GitPython Advisory).

Successful exploitation grants an attacker full control over the affected system's confidentiality, integrity, and availability, as arbitrary commands are executed in the context of the user triggering the git hook. An unprivileged local attacker can read sensitive repository data, modify files, or disrupt service availability. In CI/CD or multi-user development environments where git operations are automated, the blast radius extends to pipeline secrets, credentials, and downstream systems accessible from the compromised host (GitPython Advisory, GitHub Advisory).

1. Identify a target: Locate a system running GitPython < 3.1.50 where the attacker has local write access to a git repository or can influence arguments passed to config_writer() / set_value().
2. Prepare malicious hook directory: Create an attacker-controlled directory (e.g., /tmp/evil_hooks/) and place an executable hook script inside it (e.g., pre-commit) containing the desired payload:

#!/bin/sh
id > /tmp/rce_proof.txt

3. Inject newline into section parameter: Using GitPython's API, call set_value() with a crafted section argument containing an embedded newline to forge a [core] section:

import git
repo = git.Repo("/path/to/target/repo")
with repo.config_writer() as cw:
    cw.set_value("user]\n[core", "hooksPath", "/tmp/evil_hooks")

4. Verify injection: Confirm that .git/config now contains a [core] section with hooksPath = /tmp/evil_hooks by reading the file or running git -C /path/to/target/repo config core.hooksPath.
5. Trigger the hook: Wait for or cause a git operation that invokes the injected hook (e.g., git commit --allow-empty -m "x"). The pre-commit hook executes as the user performing the git operation, achieving RCE.
6. Collect results: Retrieve the output of the executed payload (e.g., read /tmp/rce_proof.txt to confirm code execution) (GitPython Advisory).

• File System: Unexpected or newly created directories outside the repository containing executable hook scripts (e.g., pre-commit, post-commit); .git/config containing a [core] section with a hooksPath value pointing to a non-standard or world-writable directory; modification timestamps on .git/config inconsistent with normal developer activity.
• Logs: Git operation logs showing hook execution from unusual paths; audit logs (e.g., auditd) recording writes to .git/config by unexpected processes or users.
• Process: Unexpected child processes spawned by git (e.g., /bin/sh, bash, python, curl, wget) during routine git operations; processes writing files to /tmp or other world-writable directories immediately following a git commit or hook-triggering event.
• Network: Outbound connections from developer workstations or CI/CD runners to unknown external hosts shortly after git hook execution, potentially indicating reverse shell or data exfiltration activity (GitPython Advisory).

Upgrade GitPython to version 3.1.50 or later, which validates newline characters in the section and option parameters of config_writer() in addition to value. As interim mitigations: restrict write access to .git directories to trusted users only; disable git hooks (core.hooksPath can be set to a non-existent or empty directory via a trusted configuration); and validate and sanitize any user-controlled input passed to config_writer() or set_value() in application code. Organizations using GitPython in CI/CD pipelines should treat this as a high-priority update given the potential for automated hook triggering (GitPython Advisory, GitHub Advisory).

The vulnerability was reported by researcher aslein1413-sys and published by maintainer Byron via the GitPython GitHub Security Advisory. The advisory explicitly frames this as a bypass of the prior CVE-2026-42215 patch, highlighting an incomplete fix pattern that the security community frequently criticizes. No significant broader media coverage or notable social media discussion was identified at the time of this report's preparation.