new file mode 100644
@@ -0,0 +1,61 @@
+From 46f9c03ed10d25146293003791476955f8b26a73 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Sun, 2 Aug 2026 08:57:12 +0000
+Subject: [PATCH 22/38] Reject syntax-bearing git config option names
+
+<!-- agent -->
+GHSA-jm78-9fvv-mhgr reports that config option names containing Git
+syntax can be serialized as unintended directives. A regression test showed
+that set, set_value, and add_value accepted delimiter, comment, bracket, and
+whitespace characters in option names.
+
+Restrict written option names to GitPython's established safe character set of
+letters, digits, hyphens, underscores, and dots. This blocks characters that
+can change config syntax while preserving option names historically supported
+by the writer and SectionConstraint.
+
+A broader audit confirmed that every public option-creating config API and
+SectionConstraint delegate reaches this validator; no separate config writer
+sink was found. The behavior was checked against Git cf5497b14, and the full
+config test module plus dotted-option regression pass.
+
+CVE: CVE-2026-76221
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf]
+
+Backport Changes:
+- Omit upstream regression test changes because the current PyPI
+ source archive does not include its test suite.
+
+Assisted-by: GPT 5.6
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit a495ccd3b547ccd60b2187215823b72a9c0188bf)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/config.py | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/git/config.py b/git/config.py
+index 3015bb73..ff88bd18 100644
+--- a/git/config.py
++++ b/git/config.py
+@@ -74,6 +74,9 @@ See: https://git-scm.com/docs/git-config#_conditional_includes
+ UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]")
+ """Characters that cannot be safely written in config names or values."""
+
++VALID_CONFIG_OPTION_NAME_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
++"""Pattern for option names that can be written without changing config syntax."""
++
+
+ class MetaParserBuilder(abc.ABCMeta): # noqa: B024
+ """Utility class wrapping base-class methods into decorators that assure read-only properties."""
+@@ -854,6 +857,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+ def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None:
+ if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):
+ raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label)
++ if label == "option" and isinstance(name, str) and not VALID_CONFIG_OPTION_NAME_RE.fullmatch(name):
++ raise ValueError("Git config option names may contain only letters, digits, '-', '_', or '.'")
+ if label == "section" and isinstance(name, str):
+ in_quotes = False
+ escaped = False
+--
+2.35.6
@@ -35,6 +35,7 @@ SRC_URI += " file://CVE-2026-42284.patch \
file://CVE-2026-73621.patch \
file://CVE-2026-73620.patch \
file://CVE-2026-73619.patch \
+ file://CVE-2026-76221.patch \
"
SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf [2] https://www.cve.org/CVERecord?id=CVE-2026-76221 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python/python3-git/CVE-2026-76221.patch | 61 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 62 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch