Attack Chain

1. An attacker crafts a malicious submodule name, such as 'x"] [core] sshCommand=CMD #', designed to close the legitimate [submodule " section and open a new [core] section with an injected sshCommand.
2. The attacker convinces a victim to either use Repo.create_submodule with this malicious name (e.g., in a development tool or application accepting untrusted input) or to clone an untrusted Git repository containing this malicious submodule name in its .gitmodules file and then execute submodule_update.
3. GitPython's config writer (e.g., fp.write(("[%s]\n" % name).encode(defenc))) processes the crafted submodule name without adequately escaping the special characters.
4. The malicious name is written into the victim's repository-local .git/config file, resulting in an entry like [submodule "x"] [core] sshCommand=CMD #"].
5. The Git client parses this malformed entry, treating [core] sshCommand=CMD as a valid configuration directive due to the unescaped ] closing the submodule section and [ opening a new core section on the same line.
6. The core.sshCommand configuration is now set to an attacker-controlled command (e.g., CMD).
7. Upon the victim's next Git operation that requires SSH (e.g., git fetch, git pull, git push), the configured core.sshCommand is executed by the system.
8. The attacker's command CMD is executed on the victim's machine, achieving remote code execution.

Impact

Successful exploitation of this vulnerability grants attackers arbitrary code execution on the victim's system, operating under the privileges of the user executing the Git operation. This can lead to complete system compromise, data exfiltration, or further lateral movement within an organization's network. The attack is highly effective because it leverages Git's trusted configuration mechanism. It can be triggered by common Git operations like fetch, pull, or push that use SSH, affecting developers, CI/CD systems, and any environment processing Git repositories with GitPython. While primarily observed as a Unix vector for the clone_from + submodule_update path, the direct create_submodule API sink remains exploitable across Windows, Linux, and macOS platforms.

Recommendation

• Upgrade GitPython to a version greater than 3.1.52 immediately to remediate GHSA-3rp5-jjmw-4wv2.
• Implement rigorous input validation and sanitization for any application that constructs Git submodules from untrusted input using Repo.create_submodule.
• Educate users to exercise caution when cloning or initializing submodules from untrusted or unfamiliar Git repositories, as this can be a vector for core.sshCommand injection.
• Monitor process creation logs for unusual commands executed by Git or SSH processes, as this could indicate RCE via an injected core.sshCommand (requires enabling Sysmon or similar granular logging).