Root cause
Validation & fail-open logic
This setter validates the value before passing section and option names through unchanged.
GitPython validated configuration values but left section and option names unchecked. The repair rejects carriage returns, newlines and NUL characters in configuration names.
How AI contributed: Flawed AI-written codePublished May 6, 2026 in 
gitpython-developers/gitpythonAll 8 findings in this repository
Provisional finding. Full causal and release verification remains incomplete.
Fix
Security fix
The repaired setter validates both section and option names before writing configuration.
Case facts
- CVE ID
- CVE-2026-67326
- GHSA ID
- GHSA-MV93-W799-CJ2W
- Published
- May 6, 2026
- Severity
- high
- Language
- Python
- AI tool
ChatGPT/Codex- AI role
- Flawed AI-written code
- Vulnerable release
- 3.1.49
- Fixed release
- 3.1.50
AI-assisted change
AI-assisted changegit/config.pysource gitpython-developers/gitpython@c417af469f+8−0
@@ -885,5 +895,13 @@+ section: str,+ option: str,+ value: Union[str, bytes, int, float, bool, None] = None,+ ) -> None:+ if value is not None:+ value = self._value_to_string_safe(value)+ return super().set(section, option, value)+ @needs_values @set_dirty_and_flush_changesShow 3 hidden lines
def set_value(self, section: str, option: str, value: Union[str, bytes, int, float, bool]) -> "GitConfigParser": """Set the given option in section to the given value. This setter validates the value before passing section and option names through unchanged.
Security fix
Fixgit/config.pysource gitpython-developers/gitpython@54538428f7+2−0
@@ -894,10 +902,12 @@ self, section: str, option: str, value: Union[str, bytes, int, float, bool, None] = None, ) -> None:+ self._assure_config_name_safe(section, "section")+ self._assure_config_name_safe(option, "option") if value is not None: value = self._value_to_string_safe(value) return super().set(section, option, value)Show 2 hidden lines
@needs_valuesThe repaired setter validates both section and option names before writing configuration.
Patch fingerprints
AI-assisted change e4e0f238db6f6504f0cf2c93d3baa55d245c44090cf93ce016aa0b878ac5c177 · Fix c374aca795beb615895e583f35b8cc1fd7343e6b48ea021528d1b5fb2c3c5227