What is CVE-2026-69097?

CVE-2026-69097 is a high-severity vulnerability in Gitpython-developers Gitpython, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.0/10. Published 2026-08-03.

How severe is CVE-2026-69097?

High severity. CVSS v3 base score is 7.0 out of 10.

Vulnerability in Gitpython-developers Gitpython

CVE-2026-69097

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous…

CVSS v3 metric

CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Gitpython-developers Gitpython — versions 0, 3.1.53

Weakness classification (CWE)

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-69097?: CVE-2026-69097 is a high-severity vulnerability in Gitpython-developers Gitpython, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.0/10. Published 2026-08-03.
How severe is CVE-2026-69097?: High severity. CVSS v3 base score is 7.0 out of 10.