A code injection vulnerability in GitPython affects versions prior to 3.1.49, allowing local attackers to achieve total system compromise by injecting malicious configuration hooks.

This vulnerability is a code injection flaw (CWE-94) involving improper control of code generation where GitConfigParser.set_value() passes values to Python configparser without newline validation, requiring local user interaction with low privileges.

A successful exploit allows attackers with local access to execute arbitrary code with the privileges of the user running the GitPython operations, leading to potential complete data compromise and system takeover. The assigned CVSS score of 7.8 reflects a high severity threat due to the potential for total technical impact on confidentiality, integrity, and availability.

Immediate Action: Update PyPI/gitpython to version 3.1.49 or later immediately.

Proactive Monitoring: Monitor systems for unexpected local script executions, anomalous Git operations, and unauthorized modifications to local Git configuration files.

Compensating Controls: Restrict local user access permissions and enforce strict adherence to the principle of least privilege on host systems running GitPython dependencies.

Public Exploit Available: No (false / unknown)

This vulnerability presents a high risk for environments executing untrusted Git repositories with affected versions of GitPython. Organizations must prioritize applying the vendor security update to version 3.1.49 immediately to eliminate the code injection vector and prevent unauthorized command execution.