Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-76221

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 30.4%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2026-76221


Contact Us

Shodan ® - All rights reserved