Vulnerability in Gitpython-Developers Gitpython
CVE-2026-69097
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (19.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 19.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Gitpython-Developers Gitpython — versions 0, 3.1.53
- Gitpython Project
Weakness classification (CWE)
References
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4w… (Exploit, vendor-advisory, Mitigation, Vendor Advisory)
- www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-na… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-69097?
- CVE-2026-69097 is a high-severity vulnerability in Gitpython-Developers Gitpython, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.0/10. Published 2026-08-03.
- How severe is CVE-2026-69097?
- High severity. CVSS v3 base score is 7.0 out of 10.