High severity · published Aug 3, 2026
CVE-2026-69097
GitPython before 3.1.53 Config Injection via Submodule Names
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
GitPython · gitpython-developers
before 3.1.53 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-69097
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-69097
Exploit
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2
Third Party Advisory
https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-names
More from GitPython
9.8
CVE-2026-78676
GitPython before 3.1.59 Remote Code Execution via Config Injection
9.8
CVE-2026-67324
GitPython 3.1.50 Authentication Bypass via Joined Short Options
9.8
CVE-2026-42284
GitPython: Unsafe option check validates multi_options before shlex.split transforms it
8.8
CVE-2026-87817
GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
8.8
CVE-2026-76221
GitPython before 3.1.58 Config Injection via option-name