CVE-2026-69097 HIGH

CVE-2026-69097: GitPython before 3.1.53 Config Injection via Submodule Names

Vendor Gitpython-Developers

Product GitPython

Weakness CWE-74

Published August 3, 2026

Last update August 3, 2026

View on NVD All CVEs

CVSS base score

7.3/10

Attack vector Local

Attack complexity High

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

Key dates

02Disclosure timeline

August 3, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-69097 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/74.html AskarLabs — CWE-74 write-up Improper Neutralization of Special Elements in Output ('Injection')

Related vulnerabilities

04Related CVE

CVE-2019-25150 Email Templates <= 1.3 - HTML Injection CVE-2024-38700 WordPress WPCS – WordPress Currency Switcher Professional plugin <= 1.2.0.3 - Arbitrary Shortcode Execution vulnerability CVE-2024-35728 WordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerability CVE-2026-6279 Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler CVE-2026-2019 Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting