Hi,

The following vulnerability was published for python-git.

CVE-2026-69097[0]:
| GitPython before 3.1.53 fails to properly escape section names in
| git config files, allowing attackers to inject arbitrary
| configuration directives through malicious submodule names.
| Attackers can inject core.sshCommand or other dangerous config keys
| into the victim's .git/config via create_submodule or clone_from
| operations, achieving remote code execution when git performs ssh
| operations.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-69097
https://www.cve.org/CVERecord?id=CVE-2026-69097
[1] https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore