CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.53 are vulnerable due to improper escaping of section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. This vulnerability can lead to remote code execution during SSH operations, posing a significant risk to systems that utilize GitPython for version control. Organizations that rely on GitPython for managing repositories should prioritize updating to the latest version to mitigate this high-severity threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.