Summary
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
GitPython's config-name validator only neutralizes CR/LF/NUL for the "option" label; it does not reject =, #, ;, [, ], or whitespace in an option name. write_section writes the option name verbatim into the config file, so an option name such as sshCommand = touch <cmd> # is written as \tsshCommand = touch <cmd> # = <value>, which git parses as core.sshCommand = touch <cmd> (the trailing # comments out the intended value). This forges arbitrary config directives (core.sshCommand, core.hooksPath, alias.*) → RCE on the next git operation. This is a distinct field (option name, not section name) and distinct character class (=/#/space, not newline/bracket) from GHSA-3rp5-jjmw-4wv2 (section-name bracket injection) and GHSA-mv93-w799-cj2w / GHSA-v87r-6q3f-2j67 (newline injection).
Root Cause
_assure_config_name_safe(name, label) (git/config.py:897) applies the bracket/quote state machine ONLY when label == "section"; for the "option" label it falls through with just the UNSAFE_CONFIG_CHARS_RE = [\r\n\x00] regex. write_section then writes the option name verbatim into "\t%s = %s\n" (config.py:702).
Proof of Concept
with repo.config_writer() as cw:
cw.set_value("core", "sshCommand = touch /tmp/RCE #", "x")
# git config --get core.sshCommand -> touch /tmp/RCE
Attack Chain
- Entry: app calls config writer with attacker-controlled OPTION name:
set_value("core", "sshCommand = touch /tmp/RCE #", "x"). - Check:
_assure_config_name_safe(option, "option")@ config.py. Guard: regex matches only[\r\n\x00]; bracket/quote state machine is gated onlabel=="section". Bypass proof:=,#,space pass → noValueError. - Sink:
write_sectionwrites"\tsshCommand = touch /tmp/RCE # = x\n"(config.py:702). - Impact: git parses
core.sshCommand=touch /tmp/RCE→ arbitrary code execution on next git op.
Bypass Evidence
Independently reproduced (gate harness): set_value('core','sshCommand = touch <RCE> #','x') → no ValueError; file line sshCommand = touch <RCE> # = x; git config --get core.sshCommand → touch <RCE> (rc=0). Also verified core.hooksPath via both GitConfigParser and repo.config_writer(). Fix-commit read: bracket/quote checks are inside if label == "section"; the "option" label is not covered.
Affected Versions
GitPython <= 3.1.57 (validator present verbatim on the latest release tag).
Impact
Arbitrary git-config directive injection → remote code execution via core.sshCommand (fires on any ssh git operation, no staged file needed) or core.hooksPath (with a staged hook). Requires the embedding application to forward a caller-influenced OPTION NAME into the config writer (name-control model, the same name-control model accepted by the related published advisories GHSA-3rp5-jjmw-4wv2 and GHSA-mv93-w799-cj2w). Default configuration.
GHSA-JM78-9FVV-MHGR has a CVSS score of 8.8 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.1.58); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Apply the section-name safety checks (reject =, #, ;, [, ], whitespace) to the "option" label as well, or validate the fully-rendered config line after substitution.
Reported by zx (Jace), GitHub: @manus-use
Frequently Asked Questions
- What is GHSA-JM78-9FVV-MHGR? GHSA-JM78-9FVV-MHGR is a high-severity security vulnerability in GitPython (pip), affecting versions <= 3.1.57. It is fixed in 3.1.58.
- How severe is GHSA-JM78-9FVV-MHGR? GHSA-JM78-9FVV-MHGR has a CVSS score of 8.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of GitPython are affected by GHSA-JM78-9FVV-MHGR? GitPython (pip) versions <= 3.1.57 is affected.
- Is there a fix for GHSA-JM78-9FVV-MHGR? Yes. GHSA-JM78-9FVV-MHGR is fixed in 3.1.58. Upgrade to this version or later.
- Is GHSA-JM78-9FVV-MHGR exploitable, and should I be worried? Whether GHSA-JM78-9FVV-MHGR is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-JM78-9FVV-MHGR is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-JM78-9FVV-MHGR? Upgrade
GitPythonto 3.1.58 or later.