CVE-2026-69097
Medium
Elevated severity or exploit probability.
CVSS base
7.0
HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS — probability of exploitation (30 days)
0.3%
17.5th percentile
CISA KEV
Not listed
Weakness / dates
CWE-74
Published 2026-08-03 · modified 2026-09-16
CVSS breakdown
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | L | Local |
| Attack Complexity | H | High |
| Privileges Required | N | None |
| User Interaction | R | Required |
| Scope | U | Unchanged |
| Confidentiality | H | High |
| Integrity | H | High |
| Availability | H | High |
Timeline
- 2026-08-03 — Published (NVD)
- 2026-09-16 — Last modified (NVD)
Description
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.