Duplicate Advisory: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
Critical severity
GitHub Reviewed
Published
Aug 25, 2026
to the GitHub Advisory Database
•
Updated Sep 8, 2026
Withdrawn
This advisory was withdrawn on Sep 8, 2026
Give feedback on Dependabot alerts