GitPython is a Python library for interacting with Git repositories. In versions before 3.1.49, the set_value() function in GitConfigParser does not properly validate values for newline characters. Although GitPython attempts to sanitize newlines by converting them into indented continuation lines, Git itself treats indented [core] stanzas as valid section headers. This allows an attacker to inject a malicious core.hooksPath configuration, redirecting Git hook execution to attacker-controlled scripts during Git operations that trigger hooks. The vulnerability is identified as CWE-94 (Improper Control of Generation of Code) and has a CVSS 3.1 score of 7.8 (high severity). The issue is fixed in GitPython version 3.1.49.

Successful exploitation allows an attacker with local access and limited privileges to execute arbitrary code by injecting a malicious hooksPath configuration. This can lead to full compromise of the affected system during Git operations that invoke hooks, impacting confidentiality, integrity, and availability.

Upgrade GitPython to version 3.1.49 or later, where this vulnerability is patched. No other mitigations are documented. Patch status is not explicitly stated in the vendor advisory content, but the description confirms the issue is fixed in version 3.1.49.