new file mode 100644
@@ -0,0 +1,59 @@
+From 46f9c03ed10d25146293003791476955f8b26a73 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Sun, 2 Aug 2026 08:57:12 +0000
+Subject: [PATCH] Reject syntax-bearing git config option names
+
+<!-- agent -->
+GHSA-jm78-9fvv-mhgr reports that config option names containing Git
+syntax can be serialized as unintended directives. A regression test showed
+that set, set_value, and add_value accepted delimiter, comment, bracket, and
+whitespace characters in option names.
+
+Restrict written option names to GitPython's established safe character set of
+letters, digits, hyphens, underscores, and dots. This blocks characters that
+can change config syntax while preserving option names historically supported
+by the writer and SectionConstraint.
+
+A broader audit confirmed that every public option-creating config API and
+SectionConstraint delegate reaches this validator; no separate config writer
+sink was found. The behavior was checked against Git cf5497b14, and the full
+config test module plus dotted-option regression pass.
+
+CVE: CVE-2026-76221
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf]
+
+Backport Changes:
+- Omitted test/test_config.py because the current PyPI source
+ archive does not include the test suite and the python3-git
+ recipe does not run it.
+
+Assisted-by: GPT 5.6
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit a495ccd3b547ccd60b2187215823b72a9c0188bf)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/config.py | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/git/config.py b/git/config.py
+index cbfc7ebd..de1b9572 100644
+--- a/git/config.py
++++ b/git/config.py
+@@ -74,6 +74,8 @@ UNSAFE_CONFIG_CHARS_RE
+ UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]")
+ """Characters that cannot be safely written in config names or values."""
+
++VALID_CONFIG_OPTION_NAME_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
++"""Pattern for option names that can be written without changing config syntax."""
+
+
+ class MetaParserBuilder(abc.ABCMeta): # noqa: B024
+@@ -875,6 +877,8 @@ GitConfigParser._assure_config_name_safe
+ def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None:
+ if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):
+ raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label)
++ if label == "option" and isinstance(name, str) and not VALID_CONFIG_OPTION_NAME_RE.fullmatch(name):
++ raise ValueError("Git config option names may contain only letters, digits, '-', '_', or '.'")
+ if label == "section" and isinstance(name, str):
+ in_quotes = False
+ escaped = False
@@ -36,6 +36,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
file://CVE-2026-73620.patch \
file://CVE-2026-73619_p1.patch \
file://CVE-2026-73619_p2.patch \
+ file://CVE-2026-76221.patch \
"
SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf [2] https://security-tracker.debian.org/tracker/CVE-2026-76221 Signed-off-by: Yogita Urade <yurade@cisco.com> --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Expanded the embedded commit rationale to describe unsafe option-name serialization and the validator’s coverage. Added Assisted-by and Co-authored-by trailers. The source validator remains the same; the embedded diff removes an extra blank line. --- .../python/python3-git/CVE-2026-76221.patch | 59 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 60 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch