ghsa:GHSA-9XX9-HW38-H2W9: gitpython <= 3.1.52

Duplicate Advisory: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE). Affected range: <= 3.1.52. Fixed version: 3.1.53.

Affected technology

gitpython · <= 3.1.52
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Local · No privileges required · User interaction required

What an attacker can do

Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations. Source advisory’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high.

Published 24-Oct-2026 01:47 UTC

Product: gitpython
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-24 01:45:06.114611+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-9xx9-hw38-h2w9.html