{"cve":"CVE-2026-69097","nvd":{"published":"2026-08-03T14:16:30.677","modified":"2026-10-23T21:10:00.157","status":"Analyzed","description":"GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":7.3},"cwes":["CWE-74"],"references":["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2","https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-names","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2"],"products":["gitpython_project:gitpython"],"source":"nvd","synced_at":"2026-10-24T16:53:34.184483516+00:00"},"epss":{"cve":"CVE-2026-69097","score":0.00268,"percentile":0.18744,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-3rp5-jjmw-4wv2","url":"https://osv.dev/vulnerability/GHSA-3rp5-jjmw-4wv2","summary":"GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)","modified":"2026-10-23T21:47:05Z","packages":[{"ecosystem":"PyPI","name":"gitpython","purl":"pkg:pypi/gitpython","ranges":["<3.1.53"],"fixed":["3.1.53"]}]},{"id":"PYSEC-2026-3981","url":"https://osv.dev/vulnerability/PYSEC-2026-3981","summary":"","modified":"2026-09-17T09:00:03.367215284Z","packages":[{"ecosystem":"PyPI","name":"gitpython","purl":"pkg:pypi/gitpython","ranges":["<3.1.53"],"fixed":["3.1.53"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}