Path Traversal Vulnerability in GitPython Affects Multiple Versions

CVE-2026-100689

What is CVE-2026-100689?

GitPython versions before 3.1.62 are susceptible to a path traversal vulnerability that occurs when the path field from an untrusted .gitmodules file is not validated adequately during submodule updates. This vulnerability allows for potentially harmful directory creation outside the designated repository working tree. Specifically, if a .gitmodules entry contains directory traversal sequences, it may lead to directories being created with unauthorized paths, resulting in security risks. The exploitation of this issue requires specific application flows that do not utilize the standard clone-then-update methodology. A patch has been released in GitPython 3.1.62 to address this vulnerability.

References