CVE-2026-69097

Katalog CVE

CVSS 7.3 · High EPSS 0,27%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada gitpython project gitpython. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

Rincian

Terbit di NVD

3 Agustus 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2 exploit · mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-names advisory pihak ketiga