GitPython versions before 3.1.53 contain a vulnerability where section names in git config files are not properly escaped. This allows attackers to inject arbitrary configuration directives through maliciously crafted submodule names. The attack vector involves the create_submodule or clone_from operations, which can be used to inject dangerous keys such as core.sshCommand into the victim's .git/config file. Once injected, these directives are executed when git performs SSH operations, resulting in remote code execution. The vulnerability represents a significant supply chain risk for developers and organizations using GitPython for repository management. A patch was released in GitPython 3.1.53, and users are advised to upgrade immediately. The issue is tracked under CVE-2026-69097 and has been assigned a high criticality rating.