CVE-2026-69097

Aliases:GHSA-3rp5-jjmw-4wv2UBUNTU-CVE-2026-69097DEBIAN-CVE-2026-69097PYSEC-2026-3981
Advisory lineage Upstream: 0 Downstream: 2
Analyzed
Published: 03 Aug 2026, 13:20
Last modified:14 Aug 2026, 16:51

Vulnerability Summary

Overall Risk (default)
medium
39/100
CVSS Score
7.3 HIGH
v4.0 (cve.org)
EPSS Score
0.26% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

03 Aug 2026, 13:20
Published
Vulnerability first disclosed
14 Aug 2026, 16:51
Last Modified
Vulnerability information updated

Description

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

CVSS Metrics

  • v4.0•HIGH•Score: 7.3CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • v4.0•HIGH•Score: 7.3CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
  • v3.1•HIGH•Score: 7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.26%• Percentile: 18%

Techniques & Countermeasures

  • CWE-74•Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Systems

  • debian•python-git

    all | all | all | all | < 3.1.61-1

  • ubuntu•python-git

    all

  • gitpython_project•gitpython

    < 3.1.53

  • gitpython-developers•gitpython

    < 3.1.53

  • PyPI•gitpython

    < 3.1.53

References (8)