CVE-2026-76221
HighAdvisory
Published 7 Aug 2026In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.8
- base score, highest
- EPSS
- 0.005
- 40th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 52
- of 17,781 indexed, latest versions
- Container images
- 60
- deployed by those charts
- Fix available
- 1 of 1
- affected package
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
Carried by container images the latest versions of 52 of 17,781 indexed charts deploy, on 60 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| gitpythonpypi | 3.1.0, 3.1.7, 3.1.11, 3.1.17+16 more | 3.1.58 | 60 |
- OSV records
- GHSA-jm78-9fvv-mhgr
- Also known as
- PYSEC-2026-3783
Charts affected
52 by stars
Container images carrying it
60 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| cloudve/ | 4a3d7fae90bb | gitpython | 3.1.58 | 3 |
| datawire/ | 8588eafe6862 | gitpython | 3.1.58 | 2 |
| larribas/ | 05ccb0b46bfb | gitpython | 3.1.58 | 2 |
| weblate/ | 69c160d37a3c | gitpython | 3.1.58 | 2 |
| apecloud/ | 8ac9947a2c84 | gitpython | 3.1.58 | 1 |
| aristidetm/ | 469dbc951224 | gitpython | 3.1.58 | 1 |
| berkeleyskypilot/ | 3bc8bf8f4d83 | gitpython | 3.1.58 | 1 |
| berkeleyskypilot/ | 8da2f3cda472 | gitpython | 3.1.58 | 1 |
| buntha/ | 154542cc3083 | gitpython | 3.1.58 | 1 |
| checkmk/ | c11b422210c4 | gitpython | 3.1.58 | 1 |
| datagrok/ | 8c2d48c1545c | gitpython | 3.1.58 | 1 |
| datawire/ | 07f8fe4f4f8e | gitpython | 3.1.58 | 1 |
| datawire/ | 2beb65062c8b | gitpython | 3.1.58 | 1 |
| datawire/ | 9716efbdd24b | gitpython | 3.1.58 | 1 |
| evk02/ | ef6ff257ef35 | gitpython | 3.1.58 | 1 |
| galaxy/ | e5c265fe9fcd | gitpython | 3.1.58 | 1 |
| helmforge/ | 61f759a1421f | gitpython | 3.1.58 | 1 |
| helmforge/ | fcb7017327d6 | gitpython | 3.1.58 | 1 |
| ilum/ | ce5dcdeb22ba | gitpython | 3.1.58 | 1 |
| improwised/ | 97280b55cbd4 | gitpython | 3.1.58 | 1 |
| intelowlproject/ | 0b22e547ea6b | gitpython | 3.1.58 | 1 |
| kelvinsp/ | cd33e6db2a59 | gitpython | 3.1.58 | 1 |
| kyso/ | 4aa9d38ee81d | gitpython | 3.1.58 | 1 |
| langgenius/ | dcefa5f7c47c | gitpython | 3.1.58 | 1 |
| maponyacharles/ | 42d418654ebd | gitpython | 3.1.58 | 1 |
| maponyacharles/ | 7b37b092130a | gitpython | 3.1.58 | 1 |
| mondata/ | 6f94c6caf8bf | gitpython | 3.1.58 | 1 |
| networktocode/ | ed484336b1ad | gitpython | 3.1.58 | 1 |
| opencsghq/ | 2f03fead54db | gitpython | 3.1.58 | 1 |
| opencsghq/ | c36a5bac3cf0 | gitpython | 3.1.58 | 1 |
| pangeo/ | 5fbe688a4f80 | gitpython | 3.1.58 | 1 |
| robmarkcole/ | 410275726459 | gitpython | 3.1.58 | 1 |
| sirrend/ | 699e79e3d4e2 | gitpython | 3.1.58 | 1 |
| sirrend/ | 7ca688c7abf5 | gitpython | 3.1.58 | 1 |
| sruthitanneru/ | e565ea454ffd | gitpython | 3.1.58 | 1 |
| stackstorm/ | 88235ba70cad | gitpython | 3.1.58 | 1 |
| stackstorm/ | 6f56d239d280 | gitpython | 3.1.58 | 1 |
| stackstorm/ | 33ecfda16608 | gitpython | 3.1.58 | 1 |
| stackstorm/ | 4e3f8c7ca52d | gitpython | 3.1.58 | 1 |
| stackstorm/ | f190a6212195 | gitpython | 3.1.58 | 1 |
| stackstorm/ | 259503496ff9 | gitpython | 3.1.58 | 1 |
| stackstorm/ | b1de2055c362 | gitpython | 3.1.58 | 1 |
| stackstorm/ | b1a338f64773 | gitpython | 3.1.58 | 1 |
| stackstorm/ | 1c8904a3bf67 | gitpython | 3.1.58 | 1 |
| stackstorm/ | 1bf35bfaf00c | gitpython | 3.1.58 | 1 |
| stackstorm/ | 19fdfffdbba8 | gitpython | 3.1.58 | 1 |
| tachyongroup/ | 7e79b9000856 | gitpython | 3.1.58 | 1 |
| tachyongroup/ | f4f7fabe1037 | gitpython | 3.1.58 | 1 |
| weblate/ | 82848df56ecd | gitpython | 3.1.58 | 1 |
| gcr.io/ | 25d6975951f1 | gitpython | 3.1.58 | 1 |