CVE-2026-69097CWE-74

CVE-2026-69097

High · published August 3, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-08-03T18:16Z
Affected products (1)
ProductVersionsFixed in
gitpython_project/gitpython< 3.1.533.1.53
References (3)
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2 · [email protected]https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-names · [email protected]https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 AUG 13:20Z
    GitPython before 3.1.53 Config Injection via Submodule Names
    cvelistv5