high 7.8

CVE-2026-44244 json

GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

published 2026-05-06 6 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-28414 , GHSA-v87r-6q3f-2j67 , PYSEC-2026-2163

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits: 0; none known

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.

Patch / fix

fixed in 2 distros 5 links 1

pypi gitpython 3.1.49
gitpython_project gitpython 3.1.49

debian ubuntu red hat suse opensuse

python-git Debian 12 3.1.30-1+deb12u3
python-git Debian 13 3.1.44-1+deb13u1
python-git Debian 14 3.1.50-1

debian advisories DEBIAN-CVE-2026-44244

python-git Ubuntu Pro 14.04 LTS 0.3.2~RC1-3ubuntu0.1~esm3
python-git Ubuntu Pro 16.04 LTS 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4
python-git Ubuntu Pro 18.04 LTS 2.1.8-1ubuntu0.1~esm4
python-git Ubuntu Pro 20.04 LTS 3.0.7-1ubuntu0.1~esm4
python-git Ubuntu Pro 22.04 LTS 3.1.24-1ubuntu0.1~esm3
python-git Ubuntu Pro 24.04 LTS 3.1.37-3ubuntu0.1~esm2
python-git Ubuntu Pro 26.04 LTS 3.1.46-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-44244

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

rubygem-jwt satellite utils 6.19, satellite capsule 6.19, satellite 6.19 2.10.3-1.el9sat
ansible-core satellite maintenance 6.19, satellite capsule 6.19, satellite 6.19 1:2.16.19-1.el9sat
ansible-test satellite capsule 6.19, satellite 6.19 1:2.16.19-1.el9sat
openvox-server satellite capsule 6.19, satellite 6.19 8.15.2-1.el9sat
python3.12-aiohttp satellite capsule 6.19, satellite 6.19 3.14.3-1.el9pc
python3.12-gitpython satellite capsule 6.19, satellite 6.19 3.1.59-1.el9pc
receptor ansible automation platform 2.6 1.6.6-1.el10ap
receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.6-1.el9ap

red hat advisories RHSA-2026:63385 RHSA-2026:42079 RHSA-2026:42078

python-GitPython SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 3.1.34.1693646983.2a2ae77-150400.9.8.1

suse advisories SUSE-SU-2026:4072-1

python-GitPython openSUSE Tumbleweed 3.1.49-1.1

opensuse advisories openSUSE-SU-2026:10758-1

github.com/gitpython-developers/GitPython/releases/tag/3.1.49 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-44244 updated 2026-11-04 cvss 7.3

GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration

Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9
affected: workaround, no fix available
Red Hat AI Inference Server rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-24/controller-rhel8
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat Satellite 6 python-gitpython
affected: workaround, no fix available
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/controller-rhel8 1789607021
fixed: vendor fix RHSA-2026:71210
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-gitpython 3.1.50-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-gitpython 3.1.50-1.el9ap
fixed: vendor fix RHSA-2026:42078
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1783979593, ansible-automation-platform-26/hub-rhel9 1789611274, ansible-automation-platform-26/controller-rhel9 1789673739
fixed: vendor fix RHSA-2026:71179
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-gitpython 3.1.50-1.el9ap
fixed: vendor fix RHSA-2026:42079

show 8 more

Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1788918708, ansible-automation-platform-27/controller-rhel9 1787220257
fixed: vendor fix RHSA-2026:59153
Red Hat OpenShift AI 2.25 rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 1788185839, rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 1788185798, rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 1788185733, rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 1788185436, rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 1788185848, rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 1788185899, +4 more
fixed: vendor fix RHSA-2026:65126
Red Hat OpenShift AI 3.4 rhoai/odh-th06-cpu-torch210-py312-rhel9 1787076778, rhoai/odh-th06-rocm64-torch291-py312-rhel9 1787076481, rhoai/odh-th06-cuda130-torch210-py312-rhel9 1787077779, rhoai/odh-training-cuda128-torch29-py312-rhel9 1786611803, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1787073873, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 1787073611, +14 more
fixed: vendor fix RHSA-2026:60520
Red Hat Satellite 6.18 satellite/iop-vmaas-rhel9 1789611858, satellite/iop-vulnerability-engine-rhel9 1789637082
fixed: vendor fix RHSA-2026:68764
Red Hat Satellite 6.19 satellite/iop-vmaas-rhel9 1789611998, satellite/iop-vulnerability-engine-rhel9 1789607605
fixed: vendor fix RHSA-2026:68780
Red Hat Satellite 6.19 for RHEL 9 python3.12-gitpython 3.1.59-1.el9pc
fixed: vendor fix RHSA-2026:63385
Red Hat Migration Toolkit for Applications 8 mta/mta-solution-server-rhel9 Red Hat AI Inference Server rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9 Red Hat Ansible Automation Platform 2 python-gitpython, automation-controller, python3x-gitpython 3.1.40-1.el8ap, python3.11-gitpython 3.1.41-1.el9ap, ansible-automation-platform-25/hub-rhel8 Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-rhel8 1789606395, ansible-automation-platform-25/gateway-rhel8 1789605572, ansible-automation-platform-25/hub-web-rhel8 1789690469, ansible-automation-platform-25/receptor-rhel8 1789590330, ansible-automation-platform-25/de-minimal-rhel8 1789634812, ansible-automation-platform-25/ee-minimal-rhel8 1789652412, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.6-1.el8ap, receptorctl 1.6.6-1.el8ap, ansible-core 2.16.19-1.el8ap, ansible-test 2.16.19-1.el8ap, automation-hub 4.10.16-1.el8ap, python3.12-pyjwt 2.13.0-1.el8ap, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.6-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-core 2.16.19-1.el9ap, ansible-test 2.16.19-1.el9ap, automation-hub 4.10.16-1.el9ap, python3.12-pyjwt 2.13.0-1.el9ap, +20 more

+15 more productsfewer

Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1783969842, ansible-automation-platform-26/gateway-rhel9 1789666472, ansible-automation-platform-26/hub-web-rhel9 1783982443, ansible-automation-platform-26/hub-web-rhel9 1789615881, ansible-automation-platform-26/receptor-rhel9 1783962464, ansible-automation-platform-26/receptor-rhel9 1789610120, +53 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.6-1.el9ap, molecule 26.6.0-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-sign 0.1.6-1.el9ap, ansible-lint 26.6.0-1.el9ap, ansible-core 2.16.19-1.el9ap, +39 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.6-1.el10ap, molecule 26.6.0-1.el10ap, receptorctl 1.6.6-1.el10ap, ansible-sign 0.1.6-1.el10ap, ansible-lint 26.6.0-1.el10ap, ansible-core 2.16.19-1.el10ap, +9 more Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1787223293, ansible-automation-platform-27/gateway-rhel9 1787218409, ansible-automation-platform-27/gateway-rhel9 1788918510, ansible-automation-platform-27/hub-web-rhel9 1787225966, ansible-automation-platform-27/hub-web-rhel9 1788924567, ansible-automation-platform-27/receptor-rhel9 1787216969, +56 more Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, python3, tkinter, python-libs, python-test, python-tools, +4 more Red Hat Enterprise Linux 8 numpy, scipy, PyYAML, python3, mod_wsgi, python36, +89 more Red Hat Enterprise Linux 9 python3, python3.9, python3.11, python3.12, python3.14, python3-idle, +21 more Red Hat Enterprise Linux 10 python3.12, python3.14 Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/bootc-azure-cuda-rhel9, rhelai3/bootc-azure-rocm-rhel9 Red Hat Hardened Images llvm, rust, llvm21, swift-lang Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-feature-server-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhoai/odh-th06-cuda130-torch291-py312-rhel9, rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1788331391, rhoai/odh-vllm-cpu-rhel9 1786712073, rhoai/odh-dashboard-rhel9 1788312226, rhoai/odh-modelmesh-rhel9 1788319539, rhoai/odh-operator-bundle 1788332816, rhoai/odh-vllm-cuda-rhel9 1786710989, +61 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1787330837, rhoai/odh-automl-rhel9 1786612415, rhoai/odh-mlflow-rhel9 1787226790, rhoai/odh-autorag-rhel9 1786612637, rhoai/odh-trainer-rhel9 1787089049, +80 more Red Hat OpenShift Container Platform 4 openshift4/microshift-bootc-rhel9

not affected: vulnerable code not present
Red Hat OpenStack Platform 16.2 python3-GitPython Red Hat OpenStack Platform 17.1 GitPython, python3-GitPython
not affected: vulnerable code cannot be controlled by adversary

1 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 6 mo ago (2026-05-08)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	gitpython	<3.1.49	3.1.49

Affected products

gitpython-developers GitPython

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

github.com /gitpython-developers/GitPython/releases/tag/3.1.49
web, patch, release-notes
github.com /gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67
exploit, web, mitigation, vendor-advisory, evidence
nvd.nist.gov /vuln/detail/CVE-2026-44244
advisory
github.com /gitpython-developers/GitPython
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary