Five vulnerabilities in GitPython before 3.1.59, topped by a critical unsafe re-serialization of multi-line git-config values — a dormant newline-laden value becomes a live directive (e.g. core.hooksPath) after any unrelated GitConfigParser write, so a hook-triggering op runs attacker scripts → RCE. Others: arbitrary file read in TagReference.create(), incomplete unsafe-option denylist, –separate-git-dir clone bypass, and merge_includes enabled on .gitmodules parse. Affected: GitPython < 3.1.59.Upgrade to 3.1.59.