CVE-2026-44244

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44244", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T16:33:55.844Z", "datePublished": "2026-05-07T18:22:39.704Z", "dateUpdated": "2026-05-09T03:56:04.115Z"}, "containers": {"cna": {"title": "GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67"}, {"name": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49", "tags": ["x_refsource_MISC"], "url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49"}], "affected": [{"vendor": "gitpython-developers", "product": "GitPython", "versions": [{"version": "< 3.1.49", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T18:22:39.704Z"}, "descriptions": [{"lang": "en", "value": "GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \\n becomes \\n\\t), but Git still accepts an indented [core] stanza as a section header \u2014 so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49."}], "source": {"advisory": "GHSA-v87r-6q3f-2j67", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-44244"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-09T03:56:04.115Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44244", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-07T20:09:23.508810Z"}}}], "references": [{"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T20:08:36.502Z"}}], "cna": {"title": "GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath", "source": {"advisory": "GHSA-v87r-6q3f-2j67", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gitpython-developers", "product": "GitPython", "versions": [{"status": "affected", "version": "< 3.1.49"}]}], "references": [{"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67", "name": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49", "name": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \\n becomes \\n\\t), but Git still accepts an indented [core] stanza as a section header \u2014 so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T18:22:39.704Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44244", "state": "PUBLISHED", "dateUpdated": "2026-05-09T03:56:04.115Z", "dateReserved": "2026-05-05T16:33:55.844Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-07T18:22:39.704Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "GitPython", "vendor": "gitpython-developers", "versions": [{"status": "affected", "version": "< 3.1.49"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*", "matchCriteriaId": "70BE59C2-ACE5-4E12-AC75-DCCE43007E3F", "versionEndExcluding": "3.1.49", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \\n becomes \\n\\t), but Git still accepts an indented [core] stanza as a section header \u2014 so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49."}, {"lang": "es", "value": "GitPython es una biblioteca de python utilizada para interactuar con repositorios Git. Antes de la versi\u00f3n 3.1.49, GitConfigParser.set_value() pasa valores al configparser de Python sin validar los saltos de l\u00ednea. El propio _write() de GitPython convierte los saltos de l\u00ednea incrustados en l\u00edneas de continuaci\u00f3n indentadas (por ejemplo, \\n se convierte en \\n\\t), pero Git a\u00fan acepta una estrofa [core] indentada como encabezado de secci\u00f3n, por lo que el core.hooksPath inyectado se convierte en una configuraci\u00f3n efectiva. Cualquier operaci\u00f3n de Git que invoque hooks (commit, merge, checkout) ejecutar\u00e1 entonces scripts desde la ruta controlada por el atacante. Este problema ha sido parcheado en la versi\u00f3n 3.1.49."}], "id": "CVE-2026-44244", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44244", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-08T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-05-07T19:16:02.357", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.1.49)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "GitPython", "source": "cna", "vendor": "gitpython-developers"}, "product": "gitpython", "vendor": "gitpython_project"}], "created": "2026-05-07T20:45:22.134819+00:00", "updated": "2026-05-07T21:24:29.362104+00:00", "vendors": ["gitpython_project", "gitpython_project$PRODUCT$gitpython"]}