CVE-2026-69097

HighCVSS 7.3/10Last modified Oct 23, 2026

Description

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Aug 3, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-690989.8kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated atta CVE-2026-69106.4The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` short CVE-2026-691008.8LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that e CVE-2026-691017.7Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side CVE-2026-691029.8MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows una CVE-2026-691047.6An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information CVE-2026-691058.1An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integ CVE-2026-691068.8A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted con CVE-2026-691075.9An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.CVE-2026-691086.0A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local CVE-2026-691097.5A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path CVE-2026-69119.8Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative