CVE-2026-69097: GitPython before 3.1.53 Config Injection via Submodule Names
Vulnerability summary
CVE-2026-69097 is a high (CVSS 7.3) vulnerability in gitpython_project gitpython. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.9% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 1 · Downstream 3 · Related 3Timeline
- 03-08-2026PublishedVulnerability first disclosed.
- 14-08-2026Last modifiedVulnerability information updated.
Description
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.
CVSS metrics
10 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- NVDNIST7.3HighCVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · PypiEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · WolfiEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.27% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundGitpython
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard7 products
- awx< 24.6.1-r46
- datahub-ingestion< 1.6.0-r5
- datahub-ingestion-fips< 1.6.0-r6
- jupyter-all-spark-notebook< 7.5.6_git20260807-r0
- mlflow< 3.16.0-r0 | < 3.14.0-r2
Debian1 product
- python-gitAll versions (No fix recorded) | < 3.1.30-1+deb12u3 | < 3.1.44-1+deb13u1 | < 3.1.61-1
Gitpython_project1 product
- gitpython< 3.1.53
Gitpython-developers1 product
- gitpython< 3.1.53
PyPI1 product
- gitpython< 3.1.53
Ubuntu1 product
- python-gitAll versions (No fix recorded)
Wolfi1 product
- mlflow< 3.16.0-r0 | < 3.14.0-r2
7 vendors · 13 products
References
10 links- github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2Vendor AdvisoryWEBEVIDENCEREPORTExploitMitigation
- www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-namesThird Party AdvisoryAdvisoryREPORTWEB
