DEBIAN-CVE-2026-100689
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-100689
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100689.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-100689
- Upstream
- Published
- 2026-09-26T14:16:53Z
- Modified
- 2026-09-27T05:00:06Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L CVSS Calculator
- Summary
- [none]
- Details
-
GitPython before 3.1.62 does not validate the
pathfield read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain thenamefield, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the rawpathvalue without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can therefore cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL on the clone path, and removed via shutil.rmtree() when force_remove is used. Exploitation requires an application flow that updates submodules at a non-HEAD commit (such as a historical-commit API); the common clone-then-update flow re-derives the path from a canonical tree lookup and is not affected. The issue is fixed in GitPython 3.1.62. - References
Affected packages
Debian:12 / python-git
Package
- Name
- python-git
- Purl
- pkg:deb/debian/python-git?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:13 / python-git
Package
- Name
- python-git
- Purl
- pkg:deb/debian/python-git?arch=source&distro=trixie
Debian:14 / python-git
Package
- Name
- python-git
- Purl
- pkg:deb/debian/python-git?arch=source&distro=forky