CVE-2026-76222
HighCVSS 8.2Summary
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.
Risk Assessment
An attacker can overwrite or create files in arbitrary filesystem locations, potentially leading to privilege escalation or system integrity compromise.
Recommendation
Upgrade GitPython to version 3.1.58 or later. Avoid initializing submodules from untrusted repositories.
Original NVD description (English source)
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.