critical
CVE-2026-78676
gitpython: GitPython before 3.1.59 Remote Code Execution via Config Injection
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by GHSA, Red Hat.
Description
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| pip::GitHub Security Advisory pip | gitpython | 3.1.59 |
| Red Hat | python-gitpython, python3.12-gitpython, rhosp-rhel8/openstack-mistral-api and 9 more | no fix listed |
| alpine 3.24 | py3-gitpython | 3.1.61-r0 |
| alpine edge | py3-gitpython | 3.1.61-r0 |
| chainguard | mlflow | 3.16.0-r0 |
| debian 11 | python-git | no fix listed |
| debian 12 | python-git | no fix listed |
| debian 13 | python-git | no fix listed |
| debian 14 | python-git | 3.1.61-1 |
| echo | python-git | 3.1.59 |
| echo pip::Echo OSV | gitpython | 3.1.59 |
| minimos | checkov, mageai, mlflow and 1 more | 3.3.10-r0 and 3 more |
Show all 36 entries from 21 sources
| Source | Package | Fixed in |
|---|---|---|
| pip::GitHub Security Advisory pip | gitpython | 3.1.59 |
| Red Hat | python-gitpython | no fix listed |
| Red Hat | python3.12-gitpython | no fix listed |
| Red Hat | rhosp-rhel8/openstack-mistral-api | no fix listed |
| Red Hat | rhosp-rhel8/openstack-mistral-base | no fix listed |
| Red Hat | rhosp-rhel8/openstack-mistral-engine | no fix listed |
| Red Hat | rhosp-rhel8/openstack-mistral-event-engine | no fix listed |
| Red Hat | rhosp-rhel8/openstack-mistral-executor | no fix listed |
| Red Hat | rhosp-rhel8/openstack-nova-scheduler | no fix listed |
| Red Hat | rhosp-rhel8/openstack-tripleoclient | no fix listed |
| Red Hat | rhosp-rhel9/openstack-tripleoclient | no fix listed |
| Red Hat | satellite/iop-vmaas-rhel9 | no fix listed |
| Red Hat | satellite/iop-vulnerability-engine-rhel9 | no fix listed |
| alpine 3.24 | py3-gitpython | 3.1.61-r0 |
| alpine edge | py3-gitpython | 3.1.61-r0 |
| chainguard | mlflow | 3.16.0-r0 |
| debian 11 | python-git | no fix listed |
| debian 12 | python-git | no fix listed |
| debian 13 | python-git | no fix listed |
| debian 14 | python-git | 3.1.61-1 |
| echo | python-git | 3.1.59 |
| echo pip::Echo OSV | gitpython | 3.1.59 |
| minimos | checkov | 3.3.10-r0 |
| minimos | mageai | 0.9.80-r0 |
| minimos | mlflow | 3.15.2-r0 |
| minimos | py3-gitpython | 3.1.59-r0 |
| rapidfort alpine 3.20 | py3-gitpython | 3.1.61-r0 |
| rapidfort alpine 3.21 | py3-gitpython | 3.1.61-r0 |
| rapidfort alpine 3.22 | py3-gitpython | 3.1.61-r0 |
| rapidfort alpine 3.23 | py3-gitpython | 3.1.61-r0 |
| rapidfort alpine 3.24 | py3-gitpython | 3.1.61-r0 |
| rapidfort debian 12 | python-git | 0:3.1.61-1 |
| rapidfort debian 13 | python-git | 0:3.1.61-1 |
| seal pip::Seal Security Database | gitpython | 3.1.37+sp999 |
| seal pip::Seal Security Database | seal-gitpython | 3.1.37+sp999 |
| wolfi | mlflow | 3.16.0-r0 |
References
- https://access.redhat.com/security/cve/CVE-2026-78676
- https://advisory.echohq.com/cve/CVE-2026-78676
- https://github.com/gitpython-developers/GitPython
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w
- https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3786.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2026-78676
- https://www.cve.org/CVERecord?id=CVE-2026-78676
- https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection