GHSA-284h-m62q-gf8w: GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPa
HIGHCritical vulnerability — CVSS 9.8
What to do
- Critical severity — schedule an urgent patch.
- **CWE:** CWE-88 (Argument Injection) / CWE-94 (Code Injection) — via a read-then-corrupt-on-rewrite config round trip, not a direct setter argument - **Affected component:** `git/config.py` — `GitConfigParser._read()` (multi-line value decoding, lines 444-541, esp. `string_decode()` at line 460 and its call sites at 519/541) and `GitConfigParser._write()`/`write_section()` (serialization, lines ~694-712, esp. …
CVE · detail
- CVE-2026-78676nvd ↗EPSS 0.43%
● loading threat intel…
Early access
Get the next one first.
Early access opens the actor API and MCP server first, plus alerts when an adversary you follow lands on the wire. One email when it's ready. Nothing else, ever.
bot-protected