CVE-2026-100689
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the name field, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the raw path value without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL, and removed via shutil.rmtree() when force_remove is used. Fixed in GitPython 3.1.62.
Risk Assessment
Applications that update submodules at a non-HEAD commit (such as a historical-commit API) may allow an attacker to create and remove directories outside the repository. The common clone-then-update flow is not affected because it re-derives the path from a canonical tree lookup.
Recommendation
Upgrade GitPython to version 3.1.62 or later. Avoid updating submodules at non-HEAD commits based on untrusted .gitmodules files.
Other vulnerabilities in GitPython
See all- CVE-2026-44244High
GitPython is a Python library used to interact with Git repositories. In versions prior to 3.1.49, the GitConfigParser.set_value() method did not validate values for newlines, allowing for the injection of malicious paths into Git configuration.
- CVE-2026-44243High
GitPython is a Python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability allowed attackers to manipulate files outside the repository's .git directory due to insufficient validation of reference paths.
- CVE-2026-42284High
GitPython is a Python library used to interact with Git repositories. In versions prior to 3.1.47, the _clone() function improperly validates multi_options, allowing malicious hooks to be executed during repository cloning.
- CVE-2026-42215High
GitPython is a Python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, the library blocks dangerous Git options, but equivalent Python kwargs can bypass that check, leading to arbitrary command execution.
- GHSA-w8jc-g24h-crhwHigh
GitPython spent 2022-2026 rolling out two reusable guards method-by-method: Git.check_unsafe_protocols(url) (raises UnsafeProtocolError for <transport>:: remote-helper URLs) and Git.check_unsafe_options(...) (raises UnsafeOptionError for denylisted options). The description indicates the rollout did not cover all code paths.
- GHSA-m64x-33q8-m5h7High
This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor._from_string regex-free, but parse_actor_and_date still runs _re_actor_epoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epo...
- GHSA-jm78-9fvv-mhgrHigh
GitPython's config-name validator only neutralizes CR/LF/NUL for the "option" label; it does not reject =, #, ;, [, ], or whitespace in an option name. write_section writes the option name verbatim into the config file, so an option name such as sshCommand = touch <cmd> can inject configuration.
- GHSA-59cr-6r3x-644wMedium
GitPython 3.1.61 (and main) has a gap in git/objects/submodule/base.py — the fix for GHSA-hmq2-w58f-27jc added Submodule._validated_name(), but the description does not fully specify the scope. The code is identical in 3.1.61 and main.
- GHSA-f9j4-qggq-h239High
In GitPython, Remote.pull() forwards its positional refspec argument directly to the git pull child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the refspec (e.g., a user-supplied branch name) may allow injection of unsafe options.
- GHSA-gq48-pqfc-9p58Medium
GitPython's public Submodule.move() API verifies that its destination is lexically inside the parent repository, but does not reject symbolic links in the destination's intermediate components before filesystem operations. On systems that check out Git symlinks, an untrusted repository may exploit this.
Original NVD description (English source)
GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the `name` field, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the raw `path` value without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can therefore cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL on the clone path, and removed via shutil.rmtree() when force_remove is used. Exploitation requires an application flow that updates submodules at a non-HEAD commit (such as a historical-commit API); the common clone-then-update flow re-derives the path from a canonical tree lookup and is not affected. The issue is fixed in GitPython 3.1.62.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS