GitPython CVE-2026-44244 Allows Remote Code Execution via HooksPath Injection

The National Vulnerability Database has disclosed CVE-2026-44244, a high-severity vulnerability in GitPython versions prior to 3.1.49. This flaw, rated 7.8 CVSS, stems from GitConfigParser.set_value() failing to validate input for newlines before passing values to Python’s configparser. While GitPython attempts to mitigate newlines by converting them into indented continuation lines, Git itself still interprets an indented [core] stanza as a valid section header.

This parsing discrepancy enables an attacker to inject a malicious core.hooksPath configuration. Any subsequent Git operation that triggers hooks (such as commit, merge, or checkout) will then execute scripts from an attacker-controlled path. This is a critical code execution vector, as it allows arbitrary code to run on a developer’s machine or a CI/CD pipeline.

Defenders must understand the attacker’s calculus here: this is about supply chain poisoning and developer workstation compromise. An attacker isn’t just trying to break a single application; they’re aiming for persistence and lateral movement within the development environment. Patching GitPython is non-negotiable, but also consider the broader implications of how Git repositories are handled and who has write access.