Summary
GitPython fails to correctly escape submodule names when writing git configuration, allowing crafted names to inject arbitrary config directives into .git/config.
If an attacker can influence submodule names used in create_submodule or clone_from, they may insert dangerous keys like core.sshCommand and gain remote code execution when Git performs SSH operations.
Affected context
This vulnerability appears in applications and automation that rely on GitPython (before 3.1.53) to manage repositories and submodules.
It is relevant when:
- GitPython processes repositories or submodules whose names are derived from untrusted or semi-trusted input
- The resulting repositories are initialized with a
.git/configthat Git later uses for SSH or other external commands - Git operations like
clone,fetch, orsubmodulecommands trigger SSH connections based on configuration entries
Environments that automatically clone or register submodules provided by external parties are particularly exposed.
Exploit preconditions
- Attack surface: GitPython-powered workflows that clone repositories or create submodules, including CI/CD pipelines, automation scripts, web services, and developer tools.
- Required access: Ability to control or influence submodule names or repository content processed by GitPython (for example, by hosting a repository with malicious submodule entries or providing parameters that become submodule names).
- Trigger point: Execution of GitPython operations such as
create_submoduleorclone_fromthat write to.git/config, followed by Git commands (often via GitPython or other tooling) that use SSH for remote operations. - Why exploitation is possible: Submodule names are written into the git config without robust escaping or validation of the section name context, enabling crafted names to break out of the intended section and inject arbitrary configuration directives like
core.sshCommand.
Why this happens
The core issue maps to CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection).
GitPython treats submodule names as data but fails to neutralize special characters significant to git config syntax when emitting them into .git/config.
As a result, an attacker-controlled submodule name can manipulate the structure of the generated configuration, effectively injecting new keys or altering existing ones.
When these injected keys influence command execution—for example, by overriding core.sshCommand—subsequent Git operations execute attacker-controlled commands, leading to code execution.
Potential impact
- Remote code execution when Git performs SSH operations using an injected
core.sshCommand - Execution of arbitrary system commands under the privileges of the process running GitPython
- Compromise of CI/CD runners, build agents, or deployment pipelines that automatically process untrusted repositories
- Exfiltration of sensitive repository data or credentials via malicious SSH commands
- Lateral movement within environments where Git-based automation has elevated permissions
General mitigation guidance
Effective mitigation focuses on neutralizing untrusted values before they are written into configuration and reducing the trust placed in configuration-driven command execution:
- Treat submodule names and other identifiers that flow into
.git/configas untrusted input and apply strict validation (e.g., allowlists of safe characters and formats). - Normalize and escape configuration section names and keys using dedicated encoding/escaping routines rather than raw string interpolation.
- Avoid allowing external or user-controlled input to influence critical config directives such as
core.sshCommand,protocol.*, or other command-related keys. - Run GitPython-based automation under least-privilege accounts with constrained execution environments (e.g., restricted PATH, no unnecessary tools installed).
- Where feasible, isolate repository processing in sandboxed environments or containers that limit the impact of command execution.
How teams detect issues like this
Detection can focus on both code patterns and runtime artifacts:
- Static analysis and code review:
- Search for GitPython calls (
create_submodule,clone_from, or direct config writes) that take user or network-derived input as submodule names or config values. - Flag patterns where values are concatenated into config text or section names without escaping or validation.
- Review glue code that writes
.git/configor other Git configuration files manually. - Configuration and runtime inspection:
- Periodically scan
.git/configfiles in automated environments for unexpected or high-risk keys likecore.sshCommand,url.*.insteadOf, orprotocol.*originating from external repositories. - Monitor CI/CD logs for anomalous SSH command lines or unexpected Git behavior triggered during fetch/clone operations.
- Policy enforcement:
- Enforce policies that disallow or alert on dangerous Git configuration keys within automated workflows.
- Integrate security-focused linters or SAST tools that understand GitPython usage patterns into CI pipelines.
