Source: python-git Version: 3.1.50-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for python-git. CVE-2026-69097[0]: | GitPython before 3.1.53 fails to properly escape section names in | git config files, allowing attackers to inject arbitrary | configuration directives through malicious submodule names. | Attackers can inject core.sshCommand or other dangerous config keys | into the victim's .git/config via create_submodule or clone_from | operations, achieving remote code execution when git performs ssh | operations. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-69097 https://www.cve.org/CVERecord?id=CVE-2026-69097 [1] https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
