GitPython is a Python library for interacting with Git repositories. Versions before 3.1.49 contain a vulnerability where GitConfigParser.set_value() passes unvalidated values containing newlines to Python's configparser. Although GitPython attempts to convert embedded newlines into indented continuation lines, Git itself accepts indented [core] stanzas as valid section headers. This allows an attacker to inject a malicious core.hooksPath configuration, causing Git operations that trigger hooks to execute scripts from an attacker-controlled location. This is a code injection vulnerability classified under CWE-94. The issue is fixed in version 3.1.49.

Successful exploitation allows an attacker with local privileges to execute arbitrary code during Git operations that invoke hooks, such as commit, merge, or checkout. This can lead to full compromise of the affected system with the privileges of the user running GitPython. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability.

Upgrade GitPython to version 3.1.49 or later where this vulnerability is patched. No other vendor advisory or patch link is provided, but the fix is confirmed in version 3.1.49. Until upgrading, avoid using untrusted input in GitPython configuration values that could contain newlines.