CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.50 are vulnerable due to inadequate validation of newline characters in the section parameter of the config_writer() function, enabling attackers to inject arbitrary section headers into the .git/config file. This flaw can lead to the creation of a malicious [core] section that points to attacker-controlled directories, potentially resulting in remote code execution when git hooks are activated. Organizations using GitPython should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.