Bug 2510651 (CVE-2026-69097) - CVE-2026-69097 gitpython: GitPython: Remote Code Execution via Config Injection in Submodule Names
Summary: CVE-2026-69097 gitpython: GitPython: Remote Code Execution via Config Injecti...
Keywords:
Status: NEW
Alias: CVE-2026-69097
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-03 14:01 UTC by OSIDB Bzimport
Modified: 2026-08-27 07:34 UTC (History)
42 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-03 14:01:40 UTC 
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.
Note You need to log in before you can comment on or make changes to this bug.