Threats tagged 'ghsa-v87r-6q3f-2j67'

GitPython versions prior to 3.1.49 contain a vulnerability in the config_writer().set_value() method that allows newline injection. This flaw enables an attacker to inject a malicious core.hooksPath configuration, redirecting Git hook execution to attacker-controlled scripts. The vulnerability arises because set_value() does not validate for newline characters, and Git accepts indented [core] stanzas as valid configuration sections. This can lead to remote code execution during Git operations that invoke hooks, such as commit, merge, or checkout. The issue was fixed in GitPython 3.1.49.