--- id: CVE-2026-76221 title: >- gitpython: GitPython: Arbitrary code execution via config-name injection (CVE-2026-76221) summary: >- A flaw was found in GitPython. This vulnerability allows attackers to inject malicious configuration options by manipulating option names within the option-name validator. By injecting special characters, an attacker can forge arbitrary gi… severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cvssSource: vendor cwe: CWE-78 vendor: Red Hat product: Red Hat Ansible Automation Platform 2 affected: - ansible_automation_platform 2 - satellite 6 - satellite_6_19_for_rhel 9 - satellite 6.18 - satellite 6.19 patched: - satellite_6_19_for_rhel 9 - satellite 6.18 - satellite 6.19 published: '2026-08-19' updated: '2026-09-21' sourceUpdated: '2026-09-21T10:27:46+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76221.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76221.json - url: 'https://access.redhat.com/security/cve/CVE-2026-76221' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2519596' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-76221' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76221' - url: >- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr - url: >- https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-option-name - url: 'https://access.redhat.com/errata/RHSA-2026:63385' - url: 'https://access.redhat.com/errata/RHSA-2026:68764' - url: 'https://access.redhat.com/errata/RHSA-2026:68771' - url: 'https://access.redhat.com/errata/RHSA-2026:68780' - url: 'https://access.redhat.com/errata/RHSA-2026:68776' - url: 'https://github.com/gitpython-developers/GitPython/pull/2204' - url: >- https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf - url: 'https://github.com/gitpython-developers/GitPython' - url: 'https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58' tags: - csaf - vex - red-hat - osv - pip epss: 0.00485 epssPercentile: 0.40751 aliases: - GHSA-jm78-9fvv-mhgr - PYSEC-2026-3783 ecosystem: pip ingestedAt: '2026-08-20T19:23:06.371Z' --- ## Overview A flaw was found in GitPython. This vulnerability allows attackers to inject malicious configuration options by manipulating option names within the option-name validator. By injecting special characters, an attacker can forge arbitrary git-config directives, potentially leading to arbitrary code execution on the system when a git operation is performed. ## Vendor advisories - **RHSA-2026:63385** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63385) - **RHSA-2026:68764** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68764) - **RHSA-2026:68771** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68771) - **RHSA-2026:68780** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68780) - **RHSA-2026:68776** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68776) - **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Satellite 6 · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Satellite 6 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76221.json) **gitpython: GitPython: Arbitrary code execution via config-name injection** — rated Important by Red Hat. Released 2026-08-19, updated 2026-09-21. Affected: - Red Hat Ansible Automation Platform 2 - Red Hat Satellite 6 Fixed: - Red Hat Satellite 6.19 for RHEL 9 - Red Hat Satellite 6.18 - Red Hat Satellite 6.19 No fix planned: - Red Hat Ansible Automation Platform 2 - Red Hat Satellite 6 Not affected: - Red Hat Satellite 6.19 for RHEL 9 - Exploit Intelligence - Migration Toolkit for Applications 8 - Pen Drive Powered by Red Hat Lightspeed - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat Hardened Images - Red Hat OpenShift AI (RHOAI) - Red Hat OpenStack Platform 16.2 ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:63385 For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. https://access.redhat.com/errata/RHSA-2026:68764 For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. https://access.redhat.com/errata/RHSA-2026:68771 Workarounds / mitigations: - Do not pass untrusted or attacker-influenced git option names to GitPython. Upgrade to GitPython 3.1.58 or later, where option-name (config) injection is fixed. ## Package advisory (CVE-2026-76221) Affected packages: - `gitpython < 3.1.58` Patched in: - `gitpython 3.1.58` Source: https://osv.dev/vulnerability/GHSA-jm78-9fvv-mhgr