PT-2026-67419 · Gitpython Developers · Gitpython

CVE-2026-69097 · Publicado 2026-08-03 · Atualizado 2026-08-03

NVD

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create submodule or clone from operations, achieving remote code execution when git performs ssh operations.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2026-69097

Produtos afetados

Gitpython

Referências · 3

• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-69097 · Nota de Segurança
• https://vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-names · Nota