A critical argument injection vulnerability in GitPython allows remote attackers to execute arbitrary code by manipulating git configuration files.

This is an argument injection vulnerability (CWE-88) occurring during the re-serialization of git-config values. Improper handling of multi-line strings allows attackers to inject active directives, such as core.hooksPath, which are executed when GitPython performs subsequent configuration write operations.

Successful exploitation allows an attacker to gain full control over the execution environment by hijacking git hooks. With a CVSS score of 9.8, this represents a major risk to development pipelines and server environments that rely on GitPython for automated repository management or CI/CD processes.

Immediate Action: Update GitPython to version 3.1.59 or later to implement safe serialization of configuration values.

Proactive Monitoring: Audit logs for unusual Git command arguments or unexpected configuration changes within repositories managed by the library.

Compensating Controls: Restrict permissions for the service account running GitPython to minimize the impact if code execution is achieved.

Public Exploit Available: No (exploit_available: false)

Developers and DevOps teams should update GitPython dependencies immediately. Given the ubiquity of this library in automation tools, patching is essential to prevent supply chain compromise or unauthorized execution of malicious hooks.