https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 05:57:27 +0000 https://vulnerability.circl.lu/vuln/cve-2026-76221 <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like &#39;sshCommand = touch /tmp/RCE #&#39; to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.</p> <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like &#39;sshCommand = touch /tmp/RCE #&#39; to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.</p> https://vulnerability.circl.lu/vuln/cve-2026-76221