Configuration Injection Vulnerability in GitPython by GitPython Developers
CVE-2026-69097

7.3HIGH

Key Information:

Vendor

Gitpython-developers

Status
Gitpython
Vendor
CVE Published:
3 August 2026

What is CVE-2026-69097?

GitPython versions before 3.1.53 contain a vulnerability that allows attackers to exploit improperly escaped section names in git config files. By using malicious submodule names, attackers can inject harmful configuration directives such as core.sshCommand into the victim's .git/config. This can lead to remote code execution when git executes ssh operations, potentially compromising the user's environment. Users are urged to upgrade to the latest version to mitigate this risk and protect their repositories from unauthorized access.

Affected Version(s)

GitPython 0 < 3.1.53

GitPython 3.1.53

References

https://github.com/gitpython-developers/GitPython/securit...
vendor-advisory
https://www.vulncheck.com/advisories/gitpython-before-con...
third-party-advisory

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.