CVE-2026-69097
Received Received - Intake

GitPython Git Config Injection Leading to RCE

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69097
EUVD
EUVD-2026-52290

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gitpython gitpython to 3.1.53 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GitPython before 3.1.53 fails to properly escape section names in git config files. Attackers can inject malicious submodule names to insert arbitrary configuration directives like core.sshCommand into the victim's .git/config file. This occurs during create_submodule or clone_from operations and can lead to remote code execution when git performs SSH operations.

Detection Guidance

Check GitPython version with pip show GitPython. If version is below 3.1.53, the system is vulnerable. Inspect .git/config files for unexpected core.sshCommand or other malicious config entries.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary code on your system when git performs SSH operations. This could lead to unauthorized access, data theft, or further compromise of your system or network.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations could face legal penalties, reputational damage, and loss of trust due to compromised data.

Mitigation Strategies

Upgrade GitPython to version 3.1.53 or later. Review .git/config files for unauthorized config entries. Avoid using untrusted repositories or submodules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69097. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart