CVE-2026-69097 Details
Description
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.
A vulnerability exists in GitPython versions prior to 3.1.53, where the application fails to properly escape section names in git configuration files. This flaw allows attackers to inject arbitrary configuration directives by exploiting malicious submodule names. The injected directives can include critical commands such as 'core.sshCommand', leading to remote code execution when git performs SSH operations. The vulnerability can be exploited through 'create_submodule' or 'clone_from' operations, with the injected commands executed during the next git SSH operation.
Users can upgrade to GitPython version 3.1.53 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2 | [email protected] | ExploitMitigationVendor Advisory |
| https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-names | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gitpython project gitpython | < 3.1.53 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | Initial Analysis | [email protected] |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |