GHSA-MV93-W799-CJ2W: Remote Code Execution via Config Section Injection in GitPython Vulnerability ID: GHSA-MV93-W799-CJ2W CVSS Score: 7.8 Published: 2026-05-08 GitPython versions prior to 3.1.50 are vulnerable to a newline injection attack in the config_writer() and set_value() methods. An incomplete fix for CVE-2026-44244 failed to sanitize the configuration section parameter, allowing an attacker to inject malicious Git configuration blocks such as [core] and override the hooksPath . This leads to unauthenticated remote code execution when subsequent Git operations trigger the injected hooks. TL;DR Newline injection in GitPython's config_writer section parameter allows attackers to override core.hooksPath and achieve Remote Code Execution.…