GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.

CVE-2026-78676 affects GitPython versions before 3.1.59, where the library fails to safely re-serialize multi-line git-config values during write operations. This flaw allows dormant quoted values containing embedded newlines to be corrupted into active git directives such as core.hooksPath. An attacker can craft a malicious git config file that appears benign until any unrelated GitPython config write operation triggers the injection. Once activated, the injected directives can redirect git hooks to attacker-controlled scripts, enabling arbitrary code execution. The vulnerability is particularly dangerous in CI/CD pipelines and developer environments where GitPython is commonly used. No user interaction beyond a normal config write is required to activate the payload. The fix is available in GitPython 3.1.59 and users are strongly advised to upgrade immediately.