How AI contributed: Incomplete remediationPublished Jul 20, 2026 in 
gitpython-developers/gitpythonAll 8 findings in this repository
Summary In GitPython <= 3.1.52, the config writer neutralizes only CR, LF, and NUL in configuration names, but writes section names into the [...] header with no other escaping. A section/subsection name that contains ] [ " closes the intended header and opens a second same-line section, injecting an arbitrary config directive — with no newline required. Because a submodule name is attacker-controlled data (it comes from a repository's .gitmodules, or from an application that lets a user name a submodule) and is written verbatim into the parent repository's trusted .git/config, an attacker can set core.sshCommand (or alias.*, core.pager, core.fsmonitor) and achieve remote code execution on the victim's next git operation. Likely CWE-74 (Injection). This is a distinct variant of the injection addressed by GHSA-mv93-w799-cj2w / GHSA-v87r-6q3f-2j67: those fixed newline injection into config values/names (patched in 3.1.50); the [r\n\x00] guard added for them does not stop a same-line section break inside a name. Details The only guard applied to section/option names before writing is _assure_config_name_safe, which uses a regex that matches solely CR/LF/NUL: git/config.py:75,897-899 (GitPython 3.1.52): The name is then serialized into the header with no escaping of ], [, ", space, = or #: git/config.py:693: For submodules the name is wrapped as submodule "<name>" (git/objects/submodule/util.py:39, return f'submodule "{name}"'), which supplies the balancing quote. A submodule named: therefore serializes to the header [submodule "x"] [core] sshCommand=CMD #"]. git parses everything after the first ] on that line as a fresh section, yielding core.sshCommand=CMD (the trailing #"] is an inline comment). No CR/LF/NUL appears, so _assure_config_name_safe never fires. The attacker-controlled name reaches this sink through documented public entry points that write it into the parent repository's .git/config: · Repo.create_submodule(name=<untrusted>, ...) → Submodule.add → git/objects/submodule/base.py:619 writer.set_value(sm_section(name), "url", url) — a single call, no hostile remote required. · Repo.clone_from(<hostile url>) + repo.submodule_update(init=True) → git/objects/submodule/base.py:855 writer.set_value(sm_section(self.name), "url", self.url), where self.name is read unvalidated from the cloned repo's .gitmodules. Asymmetry: the sibling class is blocked — a newline in a config value, e.g. set_value("core", "editor", "x\n\tsshCommand=CMD"), raises ValueError. The section-name bracket payload is not caught by the same guard. PoC Single self-contained script, run against the pinned release in an ephemeral environment. Non-destructive: the injected value is an inert marker, verified parse-only with git config --get; no ssh/fetch/push is run and nothing is executed. Run: Observed output: The benign name yields a single clean [submodule "docs"] section; the malicious name yields an injected core.sshCommand. Deterministic across runs. The payload must use balanced double-quotes (an unbalanced " makes git reject the header); the submodule "<name>" wrapper balances them automatically. Impact Arbitrary attacker-controlled write into the victim's repository-local .git/config, which git fully trusts. core.sshCommand is executed as the ssh transport command on the victim's next ssh git operation (fetch/pull/push), giving remote code execution; other injectable keys (alias.*, core.pager, core.fsmonitor) fire on more common operations. Reachable in default configuration through two realistic paths: · an application that constructs a submodule from untrusted input via Repo.create_submodule(name=...) (single call); or · Repo.clone_from of an untrusted repository followed by submodule_update — the canonical submodule threat model, where the malicious name is read from the cloned .gitmodules. No non-default git settings are required. Primarily a Unix vector: on Windows the " in the resulting .git/modules/<name> directory name can abort the fresh-clone write branch (the direct config-API and create_submodule sinks are unaffected). Recommended fix Reject or escape configuration section/subsection/option names that contain ], [, ", or leading/trailing whitespace (or apply git's own section-name escaping) in _assure_config_name_safe / write_section, rather than only CR/LF/NUL. Validating submodule names before they reach sm_section would additionally close the clone-driven path.
AI-written code wrote unsanitized attacker-controlled submodule names into .git/config section headers, enabling config injection and arbitrary directive execution.
Case facts
ChatGPT/CodexOnly the highlighted steps are this advisory. The first step is the earlier flaw the AI tried, and failed, to close.
Original flaw
Earlier advisory · CVE-2026-42215Sink: GitPython git/config.py section-name serialization
Originally written by Sebastian Thiel
This advisoryCVE-2026-69097 (GHSA-3RP5-JJMW-4WV2)
AI tried to fix this
The AI-assisted change was a real security patch, but it left the same advisory reachable.
Missed: Did not reject an unquoted closing bracket in a section name.
Fixed again
This is the patch that actually stops the same attack path.
--- a/git/config.py+++ b/git/config.py@@ -72,6 +72,9 @@ CONDITIONAL_INCLUDE_REGEXP = re.compile(r"(?<=includeIf )\"(gitdir|gitdir/i|onbr See: https://git-scm.com/docs/git-config#_conditional_includes """ +UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]")+"""Characters that cannot be safely written in config names or values."""+ class MetaParserBuilder(abc.ABCMeta): # noqa: B024 """Utility class wrapping base-class methods into decorators that assure read-only@@ -778,6 +781,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): def add_section(self, section: "cp._SectionName") -> None: """Assures added options will stay in order."""+ self._assure_config_name_safe(section, "section") return super().add_section(section) @property@@ -884,10 +888,14 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): def _value_to_string_safe(self, value: Union[str, bytes, int, float, bool]) -> str: value_str = self._value_to_string(value)- if re.search(r"[\r\n\x00]", value_str):+ if UNSAFE_CONFIG_CHARS_RE.search(value_str): raise ValueError("Git config values must not contain CR, LF, or NUL") return value_str + def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None:+ if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):+ raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label)+ @needs_values @set_dirty_and_flush_changes def set(@@ -896,6 +904,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): option: str, value: Union[str, bytes, int, float, bool, None] = None, ) -> None:+ self._assure_config_name_safe(section, "section")+ self._assure_config_name_safe(option, "option") if value is not None: value = self._value_to_string_safe(value) return super().set(section, option, value)@@ -920,6 +930,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): :return: This instance """+ self._assure_config_name_safe(section, "section")+ self._assure_config_name_safe(option, "option") value_str = self._value_to_string_safe(value) if not self.has_section(section): self.add_section(section)@@ -948,6 +960,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): :return: This instance """+ self._assure_config_name_safe(section, "section")+ self._assure_config_name_safe(option, "option") value_str = self._value_to_string_safe(value) if not self.has_section(section): self.add_section(section)@@ -968,6 +982,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): """ if not self.has_section(section): raise ValueError("Source section '%s' doesn't exist" % section)+ self._assure_config_name_safe(new_name, "section") if self.has_section(new_name): raise ValueError("Destination section '%s' already exists" % new_name) --- a/test/test_config.py+++ b/test/test_config.py@@ -163,6 +163,37 @@ class TestBase(TestCase): self.assertFalse(git_config.has_section("user")) self.assertFalse(git_config.has_section("core")) + @with_rw_directory+ def test_set_value_rejects_unsafe_section_and_option_names(self, rw_dir):+ config_path = osp.join(rw_dir, "config")+ bad_keys = ("user]\n[core", "user]\r[core", "user]\x00[core")++ with GitConfigParser(config_path, read_only=False) as git_config:+ git_config.add_section("user")+ for bad_key in bad_keys:+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.add_section(bad_key)+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.set(bad_key, "hooksPath", "/tmp/hooks")+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.set("user", bad_key, "/tmp/hooks")+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.set_value(bad_key, "hooksPath", "/tmp/hooks")+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.set_value("user", bad_key, "/tmp/hooks")+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.add_value(bad_key, "hooksPath", "/tmp/hooks")+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.add_value("user", bad_key, "/tmp/hooks")+ with pytest.raises(ValueError, match="CR, LF, or NUL"):+ git_config.rename_section("user", bad_key)++ git_config.set_value("user", "name", "safe")++ with GitConfigParser(config_path, read_only=True) as git_config:+ self.assertEqual(git_config.get_value("user", "name"), "safe")+ self.assertFalse(git_config.has_section("core"))+ @with_rw_directory def test_set_and_add_value_reject_unsafe_value_characters(self, rw_dir): config_path = osp.join(rw_dir, "config")--- a/git/config.py+++ b/git/config.py@@ -897,6 +897,22 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label)+ if label == "section" and isinstance(name, str):+ in_quotes = False+ escaped = False+ for index, char in enumerate(name):+ if escaped:+ escaped = False+ elif in_quotes and char == "\\":+ escaped = True+ elif char == '"':+ if not in_quotes and (index == 0 or name[index - 1] not in " \t"):+ raise ValueError("Git config quoted subsection names must begin after whitespace")+ in_quotes = not in_quotes+ elif char == "]" and not in_quotes:+ raise ValueError("Git config section names must not contain an unquoted closing bracket")+ if in_quotes:+ raise ValueError("Git config section names must not contain an unterminated quote") @needs_values @set_dirty_and_flush_changes--- a/test/test_config.py+++ b/test/test_config.py@@ -194,6 +194,53 @@ class TestBase(TestCase): self.assertEqual(git_config.get_value("user", "name"), "safe") self.assertFalse(git_config.has_section("core")) + @with_rw_directory+ def test_writer_rejects_unquoted_section_terminators(self, rw_dir):+ config_path = osp.join(rw_dir, "config")+ bad_sections = (+ "user] [other",+ 'user"] [other"',+ 'submodule "docs"] [other',+ 'submodule "docs] [other',+ 'submodule "docs] [other\\',+ )+ safe_section = 'submodule "docs]archive"'++ with GitConfigParser(config_path, read_only=False) as git_config:+ git_config.add_section("user")+ for bad_section in bad_sections:+ with pytest.raises(ValueError, match="section name"):+ git_config.add_section(bad_section)+ with pytest.raises(ValueError, match="section name"):+ git_config.set(bad_section, "name", "value")+ with pytest.raises(ValueError, match="section name"):+ git_config.set_value(bad_section, "name", "value")+ with pytest.raises(ValueError, match="section name"):+ git_config.add_value(bad_section, "name", "value")+ with pytest.raises(ValueError, match="section name"):+ git_config.rename_section("user", bad_section)++ git_config.set_value("user", "name", "safe")+ git_config.set_value(safe_section, "name", "safe")+ self.assertEqual(git_config.get_value(safe_section, "name"), "safe")++ # A closing bracket inside a quoted subsection name is data, not a section terminator.+ with open(config_path, "rb") as config_file:+ self.assertIn(+ b'[submodule "docs]archive"]\n',+ config_file.read(),+ "a closing bracket within a quoted subsection name should be preserved",+ )++ # Reparse the file to verify that rejected names did not inject an [other] section.+ with GitConfigParser(config_path, read_only=True) as git_config:+ self.assertEqual(+ git_config.get_value("user", "name"),+ "safe",+ "rejected section names corrupted the existing section",+ )+ self.assertFalse(git_config.has_section("other"), "an unsafe section name injected an [other] section")+ @with_rw_directory def test_set_and_add_value_reject_unsafe_value_characters(self, rw_dir): config_path = osp.join(rw_dir, "config")AI-assisted change 3fd29cc988a889643ebd31d1bc683036e4f9e2e85c9b84880a9e8e64ba51b1a4 · Fix 806fcea0df5ba2e04c9edd8343a7e015257c77bac72563f44422e86fb6ee6f1c