CVE-2026-100689

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100689
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100689.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100689
Aliases
  • GHSA-59cr-6r3x-644w
Downstream
Published
2026-09-26T13:23:48Z
Modified
2026-09-28T03:48:15Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
GitPython before 3.1.62 Path Traversal via gitmodules path
Details

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the name field, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the raw path value without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can therefore cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL on the clone path, and removed via shutil.rmtree() when force_remove is used. Exploitation requires an application flow that updates submodules at a non-HEAD commit (such as a historical-commit API); the common clone-then-update flow re-derives the path from a canonical tree lookup and is not affected. The issue is fixed in GitPython 3.1.62.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100689.json"
}
References

Affected packages

Git / github.com/gitpython-developers/gitpython

Affected ranges

Type
GIT
Repo
https://github.com/gitpython-developers/gitpython
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
db47516dac750c5968b8f6d388b18712c355df50
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.1.62"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*
0.1.4
0.1.4-pre
0.1.5
0.1.6
0.2.0-beta1
0.3.0-beta1
0.3.0-beta2
0.3.1-beta1
0.3.1-beta2
0.3.2
0.3.2-RC1
0.3.2.1
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
1.*
1.0.0
1.0.1
1.0.2
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.1
2.1.10
2.1.11
2.1.12
2.1.13
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.8
2.1.9
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.28
3.1.29
3.1.3
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.38
3.1.4
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.47
3.1.48
3.1.49
3.1.5
3.1.50
3.1.51
3.1.52
3.1.53
3.1.54
3.1.55
3.1.56
3.1.57
3.1.6
3.1.7
3.1.8
3.1.9
Other
winerr_show

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100689.json"