GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers…

GitPython versions before 3.1.50 contain a critical vulnerability in the config_writer() function that fails to validate newline characters in the section parameter. This allows attackers to inject arbitrary section headers into the .git/config file. By injecting newlines, an attacker can forge a [core] section with a hooksPath pointing to an attacker-controlled directory. When git hooks are subsequently triggered, this leads to remote code execution. The vulnerability is straightforward to exploit and affects any application using the GitPython library below version 3.1.50. Users are advised to upgrade to GitPython 3.1.50 or later to remediate the issue. The vulnerability has been assigned CVE-2026-67326 and is documented in both the NVD and GitHub Security Advisories.