Vulnerability in Gitpython-Developers Gitpython
CVE-2026-69097
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.
EPSS: 0.003 (21.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Gitpython-developers Gitpython — versions 0, 3.1.53
- Gitpython_project Gitpython
Weakness classification (CWE)
References
- disclosure@vulncheck.com (Exploit, vendor-advisory, Mitigation, Vendor Advisory)
- disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-69097?
- CVE-2026-69097 is a high-severity vulnerability in Gitpython-Developers Gitpython, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.0/10. Published 2026-08-03.
- How severe is CVE-2026-69097?
- High severity. CVSS v3 base score is 7.0 out of 10.