GitPython before version 3.1.50 does not properly validate newline characters in the section parameter of the config_writer() method. This improper input validation allows attackers to inject arbitrary section headers into the .git/config file. By injecting newlines, an attacker can forge a [core] section with a hooksPath pointing to directories under their control. When git hooks execute, this can lead to remote code execution. The vulnerability is classified as high severity with a CVSS 4.0 base score of 7.3, reflecting the potential for local attack vector with high complexity and partial user interaction required.

Successful exploitation allows an attacker with local access to inject malicious configuration into the .git/config file, specifically forging the [core] section to redirect git hooks to attacker-controlled locations. This can lead to remote code execution when git hooks are triggered, posing a significant risk to system integrity and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input for the section parameter in config_writer() and restrict local access to trusted users only. Monitor vendor channels for updates regarding an official patch or workaround.