CVE-2026-69097: GitPython before 3.1.53 Config Injection via Submodule Names
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via createsubmodule or clonefrom operations, achieving remote code execution when git performs ssh operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.1.53
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69097?
CVE-2026-69097 has a severity rating of high (7).
How do I fix CVE-2026-69097?
To mitigate CVE-2026-69097, upgrade GitPython to version 3.1.53 or later.
What types of attacks are possible with CVE-2026-69097?
CVE-2026-69097 allows attackers to inject arbitrary configuration directives, potentially including core.sshCommand.
Which versions of GitPython are affected by CVE-2026-69097?
GitPython versions before 3.1.53 are affected by CVE-2026-69097.
What impact can CVE-2026-69097 have on a system?
CVE-2026-69097 can lead to unauthorized configuration changes, potentially compromising system security.