GitPython Config Re-serialization Injection Leading to RCE (CVE-2026-78676)

Technical Analysis

The flaw resides in GitPython's config serialization logic, which fails to properly escape or preserve quoting on multi-line values when rewriting .git/config or global config files. An attacker can plant a dormant, quoted multi-line value (e.g., disguised as a benign key) that, upon any subsequent GitPython-initiated config write (such as setting a remote URL or user field), gets corrupted into an active directive like core.hooksPath, pointing to an attacker-controlled script. Because git automatically invokes hooks (e.g., pre-commit, post-checkout) referenced by hooksPath during routine repository operations, this results in arbitrary code execution with the privileges of the process running GitPython. This is especially dangerous in automated environments—CI/CD pipelines, build agents, and any tooling that programmatically clones or modifies repositories using GitPython. AI agent frameworks and autonomous coding/DevOps agents that use GitPython to manage repositories, apply patches, or perform automated git operations (e.g., LangChain-based coding agents, AutoGPT-style tools, or RAG pipelines that ingest and manage git repos) are directly exposed: a poisoned repository or config file processed by such an agent could grant an attacker code execution on the host running the agent, potentially exposing API keys, credentials, and other secrets accessible to that agent process.

Affected Systems

GitPython library versions prior to 3.1.59 (Python package 'GitPython' on PyPI); any application, CI/CD pipeline, automation script, or AI agent framework that imports GitPython to perform git config read/write operations, including systems using GitPython transitively via other automation or DevOps tooling.

Indicators of Compromise

• N/A - vulnerability is in library logic, not tied to specific malware hashes/IPs/domains at this time
• Suspicious core.hooksPath entries in .git/config pointing outside standard hook directories
• Unexpected multi-line or malformed values in tracked git-config files
• Unauthorized hook scripts appearing in .git/hooks/ or custom hooksPath locations

Remediation Steps

1. 1

   Upgrade GitPython

   Update GitPython to version 3.1.59 or later, where the config serialization/quoting logic has been fixed to prevent corruption of multi-line values.

2. 2

   Audit git configs

   Scan repositories and CI/CD environments for anomalous or unexpected core.hooksPath directives or malformed multi-line config values that may indicate prior exploitation.

3. 3

   Restrict hook execution

   Configure git to disable or sandbox hook execution (e.g., via core.hooksPath overrides, containerized CI runners, or git's safe.directory protections) in automated and agent-driven pipelines.

4. 4

   Isolate agent git operations

   Run AI agents and automation tools that use GitPython in isolated, least-privilege environments (containers/sandboxes) to limit blast radius if RCE is achieved via hook injection.

5. 5

   Review third-party repo ingestion

   For RAG pipelines or agents that clone/process external repositories, validate and sanitize repository contents, including config files, before processing with GitPython.

6. 6

   Rotate exposed credentials

   If exploitation is suspected, rotate any API keys, tokens, or credentials accessible to the affected process, particularly those used by AI agents or CI/CD service accounts.