GHSA-9xx9-hw38-h2w9High· 7.0▾ TwilightDuplicate Advisory: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-3rp5-jjmw-4wv2. This link is maintained to preserve external references.
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.
gitpython <= 3.1.52Upgrade to a patched release:
gitpython 3.1.53Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69097High· 7.0GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names
GHSA-3rp5-jjmw-4wv2High· 7.0GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
GHSA-jm78-9fvv-mhgrHigh· 8.8GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
CVE-2026-114145High· 7.5GitPython validates a submodule's ".git" path only after cloning into it (RCE)
GHSA-59cr-6r3x-644wMediumGitPython submodule update path traversal can write outside the repository
GHSA-2pxq-5vcg-rq29High· 8.8Duplicate Advisory: Repository content can impersonate the git directory, leading to arbitrary code execution