CVE-2026-69097

highCVSS 7covered by 1 sourcefirst seen 2026-08-03

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

⚡ Watch CVE-2026-69097

Get an email if CVE-2026-69097 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highCVE-2026-69097: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing a…nvd · 2026-08-03

External references

NVD record for CVE-2026-69097

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-69097 status](https://www.csirts.com/badge/CVE-2026-69097)](https://www.csirts.com/cve/CVE-2026-69097)