GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2 Exploit, Mitigation, Vendor Advisory
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2 Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.3 · gitpython_projectNVD modified 2026-10-23 21:10
Affected (CPE criteria) 1
cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*
References 3
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2 Exploit, Mitigation, Vendor Advisory
- https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-names Third Party Advisory
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2 Exploit, Mitigation, Vendor Advisory